PT-2021-7144 · Oracle · Oracle Outside In Technology

Girlelecta · Published 2021-07-20 · Updated 2021-09-23 · CVE-2021-2430

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Outside In Technology version 8.5.5

Description The issue is related to insufficient input validation in the Outside In Filters component of the Oracle Outside In Technology product, which is a suite of software development kits (SDKs). This allows an unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology, resulting in the ability to cause a hang or frequently repeatable crash (complete DOS) of the system. The protocol and impact depend on the software that uses Outside In Technology.

Recommendations For version 8.5.5, consider restricting network access to the Outside In Technology component until a patch is available. As a temporary workaround, disabling the Outside In Filters component may help minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03462

CVE-2021-2430

Affected Products

Oracle Outside In Technology

References · 4

• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03462 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-2430 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2430 · Vendor Advisory