PT-2021-2916 · Oracle · Enterprise Manager For Fusion Middleware

Okan Cokun · Published 2021-04-22 · Updated 2021-04-24 · CVE-2021-2008

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Enterprise Manager for Fusion Middleware versions 11.1.1.9 through 12.2.1.3

Description The issue exists due to insufficient input validation in the FMW Control Plugin component. It allows a remote attacker to gain read access to data, modify data, or cause a partial denial of service using HTTP requests. Successful attacks can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data.

Recommendations For version 11.1.1.9, update to a newer version to mitigate the risk. For version 12.2.1.3, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the FMW Control Plugin component until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-02486

CVE-2021-2008

Affected Products

Enterprise Manager For Fusion Middleware

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-2008 · Security Note
• https://oracle.com/security-alerts/cpuapr2021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-2008 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02486 · Security Note
• https://t.me/cvenotify/13646 · Telegram Post