PT-2021-7185 · Oracle · Oracle Outside In Technology

0Xfoxone · Published 2021-07-20 · Updated 2021-09-23 · CVE-2021-2452

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Oracle Outside In Technology version 8.5.5

Description The issue is related to insufficient input validation in the Outside In Filters component of Oracle Outside In Technology, a suite of software development kits (SDKs). This can be exploited by an unauthenticated attacker with network access via HTTP, potentially leading to unauthorized actions such as causing a hang or crash of Oracle Outside In Technology, or gaining unauthorized access to modify, delete, or read critical data. The impact depends on how the software using Outside In Technology handles network data.

Recommendations For version 8.5.5, consider restricting network access to the Outside In Technology component until a fix is available, or apply configuration changes that limit the potential impact of the issue, such as validating and sanitizing all input data before it is processed by the Outside In Filters component. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03668

CVE-2021-2452

Affected Products

Oracle Outside In Technology

References · 5

• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2452 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2452 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03668 · Security Note
• https://t.me/cvenotify/17938 · Telegram Post