PT-2021-7173 · Oracle · Oracle Outside In Technology

Girlelecta · Published 2021-07-20 · Updated 2021-09-23 · CVE-2021-2423

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Outside In Technology version 8.5.5

Description The issue exists due to insufficient input validation in the Outside In Filters component of Oracle Outside In Technology. This allows a remote attacker to cause a denial of service via the HTTP protocol. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle Outside In Technology, potentially leading to unauthorized creation, deletion, or modification access to critical data.

Recommendations For version 8.5.5, consider restricting access to the Outside In Filters component until a patch is available. As a temporary workaround, avoid using the HTTP protocol to pass data directly to Outside In Technology. Restrict network access to the component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03656

CVE-2021-2423

Affected Products

Oracle Outside In Technology

References · 7

• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2423 · Security Note
• https://bdu.fstec.ru/vul/2022-03656 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2423 · Vendor Advisory
• https://t.me/cvenotify/17952 · Telegram Post
• https://t.me/cibsecurity/26336 · Telegram Post
• https://t.me/cvenotify/17953 · Telegram Post