PT-2021-7141 · Oracle · Oracle Siebel Crm

Published 2021-07-20 · Updated 2021-07-23 · CVE-2021-2368

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 21.5 and prior

Description The issue is related to insufficient input validation in the Siebel Core - Server Infrastructure component of Oracle Siebel CRM. This allows an unauthenticated attacker with network access via HTTPS to potentially compromise the system. Successful exploitation can result in unauthorized access to critical data or complete access to all accessible data within Siebel CRM.

Recommendations For Oracle Siebel CRM versions 21.5 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03459

CVE-2021-2368

Affected Products

Oracle Siebel Crm

References · 5

• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2368 · Security Note
• https://bdu.fstec.ru/vul/2022-03459 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2368 · Vendor Advisory
• https://t.me/cibsecurity/26324 · Telegram Post