PT-2021-2872 · Oracle · Oracle Database Server+1

Published 2021-04-20 · Updated 2021-04-30 · CVE-2021-2234

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c and 19c

Description The issue is related to a vulnerability in the Java VM component, which can be exploited by a low-privileged attacker with Create Session privilege and network access via Oracle Net. This can lead to unauthorized creation, deletion, or modification access to critical data or all Java VM accessible data. The vulnerability is difficult to exploit and is related to insufficient access restrictions.

Recommendations For versions 12.1.0.2, 12.2.0.1, 18c, and 19c, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2021-02433

CVE-2021-2234

Affected Products

Oracle Database

Oracle Database Server

References · 4

• https://oracle.com/security-alerts/cpuapr2021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-2234 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02433 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-2234 · Security Note