PT-2021-7184 · Oracle · Oracle Outside In Technology

Girlelecta · Published 2021-07-20 · Updated 2021-09-23 · CVE-2021-2449

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Outside In Technology version 8.5.5

Description The issue is related to insufficient input validation in the Outside In Filters component of Oracle Outside In Technology, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle Outside In Technology, potentially leading to a denial of service. The protocol and impact depend on the software that uses Outside In Technology.

Recommendations For version 8.5.5, consider disabling the Outside In Filters component until a patch is available to prevent potential exploitation. As a temporary workaround, restrict access to the Oracle Outside In Technology component to minimize the risk of exploitation. Avoid using the Oracle Outside In Technology component with network-received data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03667

CVE-2021-2449

Affected Products

Oracle Outside In Technology

References · 5

• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2449 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2449 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03667 · Security Note
• https://t.me/cvenotify/17934 · Telegram Post