PT-2021-7133 · Oracle · Oracle Secure Global Desktop

Published 2021-07-20 · Updated 2021-07-22 · CVE-2021-2447

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Secure Global Desktop version 5.6

Description The issue is related to insufficient input validation in the Server component of Oracle Secure Global Desktop, allowing a low-privileged attacker with network access via multiple protocols, including HTTP, to compromise the application. Successful attacks can result in the takeover of Oracle Secure Global Desktop, potentially impacting additional products.

Recommendations For Oracle Secure Global Desktop version 5.6, update to a version that addresses the insufficient input validation issue to prevent potential takeover of the application. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03450

CVE-2021-2447

Affected Products

Oracle Secure Global Desktop

References · 4

• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2447 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2447 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03450 · Security Note