PT-2021-3154 · Oracle · Oracle Work In Process

Published 2021-04-20 · Updated 2021-04-29 · CVE-2021-2271

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Oracle Work in Process versions 12.1.3 and 12.2.3 through 12.2.8

Description The issue is related to insufficient input validation in the Resource Exceptions component of Oracle Work in Process. This can be exploited by a remote attacker to disclose protected information or gain access to create, modify, or delete data using the HTTP protocol. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data.

Recommendations For versions 12.1.3, update to a version that includes the fix for this issue. For versions 12.2.3 through 12.2.8, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Resource Exceptions component until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-02824

CVE-2021-2271

Affected Products

Oracle Work In Process

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-2271 · Security Note
• https://oracle.com/security-alerts/cpuapr2021.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02824 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2271 · Vendor Advisory
• https://t.me/cvenotify/13917 · Telegram Post