PT-2021-1724 · Oracle · Jd Edwards Enterpriseone Orchestrator

Amey Anekar · Published 2021-01-19 · Updated 2021-01-26 · CVE-2021-2052

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Orchestrator versions prior to 9.2.5.1

Description: The issue is related to inadequate access control in the E1 IOT Orchestrator Security component. It allows an unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator, potentially leading to unauthorized read access to a subset of accessible data. The vulnerability may significantly impact additional products.

Recommendations: For versions prior to 9.2.5.1, update to version 9.2.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the E1 IOT Orchestrator Security component to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2021-00414

CVE-2021-2052

Affected Products

Jd Edwards Enterpriseone Orchestrator

References · 4

• https://oracle.com/security-alerts/cpujan2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2052 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2052 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00414 · Security Note