CVE-2021-2452
published 2021-07-21CVE-2021-2452: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.06%
60.7th percentile
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS Base Score depend on the software that uses Outside In Technology. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology, but if data is not received over a network the CVSS score may be lower. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | outside_in_technology | — | — |
| oracle_corporation | outside_in_technology | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_oracle7.5HIGH
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jenkins-2-plugins/git: stored XSS vulnerability
vendor_redhat·2021-10-06·CVSS 6.1
CVE-2021-21684 [MEDIUM] CWE-79 jenkins-2-plugins/git: stored XSS vulnerability
jenkins-2-plugins/git: stored XSS vulnerability
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
A stored cross-site scripting (XSS) vulnerability was found in the Jenkins Git plugin. Due to not escaping the Git SHA-1 checksum parameters provided to commit notifications, an attacker is able to submit crafted commit notifications to the `/git/notifyCommit` endpoint.
Statement: This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier [1]
[1] https://www.jenkins.io/doc/upgrade-guide/2.303/#SECURITY-2452
Package: jenkins (Red Hat Fuse 7) - Not affected
Package: jenkins-2-plugins (Re
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Outside In Filters — CVE-2021-2452
vendor_oracle·2021-07-15·CVSS 7.5
CVE-2021-2452 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Outside In Filters — CVE-2021-2452
Oracle Oracle Fusion Middleware Risk Matrix: Outside In Filters vulnerability
CVE: CVE-2021-2452
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
GHSA
GHSA-9q5x-p26r-832q: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters)
ghsa_unreviewed·2022-05-24
CVE-2021-2452 [MEDIUM] GHSA-9q5x-p26r-832q: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters)
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS Base Score depend on the software that uses Outside In Technology. The CVSS score assumes that the software passes dat
GHSA
Stored XSS vulnerability in Jenkins Git Plugin
ghsa·2022-05-24
CVE-2021-21684 [MEDIUM] CWE-116 Stored XSS vulnerability in Jenkins Git Plugin
Stored XSS vulnerability in Jenkins Git Plugin
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the `/git/notifyCommit` endpoint.
Jenkins Git Plugin 4.8.3 rejects Git SHA-1 checksum parameters that do not match the expected format. Existing values are sanitized when displayed on the UI.
This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#SECURITY-2452).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-07-21
Published