PT-2021-2866 · Oracle · Oracle Zfs Storage Appliance Kit

Published 2021-04-20 · Updated 2021-04-23 · CVE-2021-2149

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle ZFS Storage Appliance Kit version 8.8

Description The issue is related to insufficient input validation in the Core component of the Oracle ZFS Storage Appliance Kit. This allows a low-privileged attacker with logon access to the infrastructure where the kit is executed to compromise it. Successful attacks can result in unauthorized update, insert, or delete access to some of the kit's accessible data.

Recommendations For Oracle ZFS Storage Appliance Kit version 8.8, consider restricting access to the Core component until a patch is available. As a temporary workaround, limit the privileges of users with logon access to the infrastructure to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-02422

CVE-2021-2149

Affected Products

Oracle Zfs Storage Appliance Kit

References · 5

• https://bdu.fstec.ru/vul/2021-02422 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2149 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2149 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021042837 · Note