PT-2021-7190 · Oracle · Oracle Database Server

Emad Al-Mousa · Published 2021-07-20 · Updated 2021-07-21 · CVE-2021-2326

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.2.0.1 through 19c

Description The issue is related to insufficient input validation in the Database Vault component of Oracle Database Server. This allows a high-privileged attacker with DBA privilege and network access via Oracle Net to compromise Database Vault, resulting in unauthorized read access to a subset of Database Vault accessible data. The vulnerability can be exploited remotely using the HTTP protocol.

Recommendations For versions 12.2.0.1 and 19c, consider restricting access to the Database Vault component until a patch is available. As a temporary workaround, limit network access via Oracle Net to minimize the risk of exploitation. Avoid using the Database Vault component for sensitive data storage until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03673

CVE-2021-2326

Affected Products

Oracle Database Server

References · 5

• https://oracle.com/security-alerts/cpujul2021.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-2326 · Security Note
• https://bdu.fstec.ru/vul/2022-03673 · Security Note
• https://osv.dev/vulnerability/CVE-2021-2326 · Vendor Advisory
• https://t.me/cvenotify/17937 · Telegram Post