PT-2021-7154 · Oracle · Oracle Database

Okan Basegmez · Published 2021-07-20 · Updated 2021-07-22 · CVE-2021-2334

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database - Enterprise Edition Data Redaction versions 12.1.0.2, 12.2.0.1 and 19c

Description The issue is related to insufficient input validation in the Oracle Database - Enterprise Edition Data Redaction component. It allows a low-privileged attacker with Create Session privilege and network access via Oracle Net to compromise the component. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert, or delete access to some of the accessible data.

Recommendations For versions 12.1.0.2, 12.2.0.1, and 19c, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03508

CVE-2021-2334

Affected Products

Oracle Database

References · 4

• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2334 · Security Note
• https://bdu.fstec.ru/vul/2022-03508 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2334 · Vendor Advisory