PT-2020-5726 · Oracle · Oracle Cloud Infrastructure Data Science Notebook Sessions

Published 2020-12-09 · Updated 2021-03-08 · CVE-2021-2138

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Cloud Infrastructure Data Science Notebook Sessions (affected versions not specified)

Description: The issue is related to insufficient input validation in the Oracle Cloud Infrastructure Data Science platform, allowing a low-privileged attacker to compromise the system. This can result in unauthorized access to modify, add, or delete data, as well as read access to a subset of the data. The vulnerability can be exploited by an attacker with access to the physical communication segment attached to the hardware where the Oracle Cloud Infrastructure Data Science Notebook Sessions execute.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-01582

CVE-2021-2138

Affected Products

Oracle Cloud Infrastructure Data Science Notebook Sessions

References · 9

• https://bdu.fstec.ru/vul/2021-01582 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-2138 · Security Note
• https://t.me/cvenotify/10811 · Telegram Post
• https://t.me/cibsecurity/24386 · Telegram Post
• https://vuldb.com/?id.170602 · Note
• https://support.oracle.com/portal · Note
• https://t.me/cvenotify/10783 · Telegram Post
• https://t.me/cvenotify/10998 · Telegram Post
• https://support.oracle.com · Note