PT-2021-2760 · Oracle · Oracle E-Business Suite+1

Published 2021-04-22 · Updated 2021-04-28 · CVE-2021-2229

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.1.1 through 12.1.3

Description: The issue is related to errors in the code of the LOVs component in Oracle Depot Repair. It allows a remote attacker to gain unauthorized access to the device and disclose protected information using HTTP requests. The vulnerability can be easily exploited by a low-privileged attacker with network access via HTTP, potentially leading to unauthorized creation, deletion, or modification of critical data. Successful attacks may result in complete access to all Oracle Depot Repair accessible data.

Recommendations: For versions 12.1.1 through 12.1.3, update to a version that includes the fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2021-02301

CVE-2021-2229

Affected Products

Oracle Depot Repair

Oracle E-Business Suite

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-2229 · Security Note
• https://oracle.com/security-alerts/cpuapr2021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-2229 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02301 · Security Note