CVE-2021-2401 — XML External Entity (XXE) Injection in Corporation BI Publisher

CWE-611 — XML External Entity (XXE) InjectionCWE-200 — Sensitive Information ExposureCWE-190 — Integer Overflow or WraparoundCWE-476 — NULL Pointer Dereference7 documents6 sources
Severity
5.3MEDIUMNVD
EPSS
3.0%
top 13.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Oracle Corporation BI PublisherOracle BI Publisher
Timeline
PublishedJul 21
Latest updateJan 30

Description

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.3 (Confident…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDoracle/bi_publisher4 versions+3
▶CVEListV5oracle_corporation/bi_publisher4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-xchm-27qm-h7w6: Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO)↗2022-05-24
▶
CVEList
CVE-2021-2401: Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO)↗2021-07-20
▶

📋Vendor Advisories

3
Red Hat
kernel: ext4: kernel bug in ext4_write_inline_data_end()↗2024-01-18
▶
Red Hat
kernel: net/sched: cbs NULL pointer dereference when offloading is enabled↗2024-01-18
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: E-Business Suite - XDO — CVE-2021-2401↗2021-07-15
▶

💬Community

1
Bugzilla
CVE-2021-33631 kernel: ext4: kernel bug in ext4_write_inline_data_end()↗2024-01-30
▶
CVE-2021-2401 — XML External Entity (XXE) Injection | cvebase