PT-2021-2940 · Oracle · Enterprise Manager Base Platform

Artur Obuchowski + 1 · Published 2021-04-22 · Updated 2021-12-08 · CVE-2021-2053

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Enterprise Manager Base Platform version 13.4.0.0

Description The issue is related to insufficient input validation in the UI Framework component. It allows an unauthenticated attacker with network access via HTTP to compromise the Enterprise Manager Base Platform. Successful attacks require human interaction and may significantly impact additional products. The attacks can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data.

Recommendations For version 13.4.0.0, consider restricting access to the UI Framework component until a patch is available. As a temporary workaround, limit the use of HTTP requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-02513

CVE-2021-2053

Affected Products

Enterprise Manager Base Platform

References · 6

• 🔥 https://blog.stmcyber.com/vulns/cve-2021-2053 · Exploit
• https://oracle.com/security-alerts/cpuapr2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2053 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2053 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02513 · Security Note
• https://t.me/cvenotify/13635 · Telegram Post