CVE-2021-2337

4 documents4 sources
Severity
7.2HIGH
EPSS
1.6%
top 18.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Oracle Corporation Database - Enterprise EditionOracle Database
Timeline
PublishedJul 21
Latest updateMay 24

Description

Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise Oracle XML DB. Successful attacks of this vulnerability can result in takeover of Oracle XML DB. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vec…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDoracle/database12.1.0.2, 12.2.0.1, 19c+2
▶CVEListV5oracle_corporation/database_-_enterprise_edition12.1.0.2, 12.2.0.1, 19c+2

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-f7wx-j897-hxqf: Vulnerability in the Oracle XML DB component of Oracle Database Server↗2022-05-24
▶
CVEList
CVE-2021-2337: Vulnerability in the Oracle XML DB component of Oracle Database Server↗2021-07-20
▶

📋Vendor Advisories

1
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle XML DB — CVE-2021-2337↗2021-07-15
▶
CVE-2021-2337 (HIGH CVSS 7.2) | Vulnerability in the Oracle XML DB | cvebase.io