PT-2021-2759 · Oracle · Oracle E-Business Suite+1

Published 2021-04-22 · Updated 2021-04-29 · CVE-2021-2256

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Oracle Storage Cloud Software Appliance versions prior to 16.3.1.4.2 Oracle E-Business Suite (affected versions not specified)

Description: The issue is related to errors in the code of a subcomponent of Oracle E-Business Suite, specifically the Customer Tab component. It allows a remote attacker to gain unauthorized access to a device and disclose protected information using HTTP requests. For Oracle Storage Cloud Software Appliance, the vulnerability can be easily exploited by an unauthenticated attacker with network access via HTTP, potentially leading to the takeover of the appliance. This vulnerability may also impact additional products.

Recommendations: For Oracle Storage Cloud Software Appliance versions prior to 16.3.1.4.2, update to version 16.3.1.4.2 or later. For Oracle E-Business Suite, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2021-02300

CVE-2021-2256

Affected Products

Oracle E-Business Suite

Oracle Storage Cloud Software Appliance

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-2256 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-2156 · Security Note
• https://oracle.com/security-alerts/cpuapr2021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-2256 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02300 · Security Note