Lucene search

OracleCVE-2021-2008

HistoryApr 22, 2021 - 10:15 p.m.

CVE-2021-2008

2021-04-2222:15:12

oracle

web.nvd.nist.gov

oracle

enterprise manager

fusion middleware

vulnerability

cve-2021-2008

security

dos

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

35.4%

JSON

Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Control Plugin). The supported version that is affected are 11.1.1.9 and 12.2.1.3 Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager for Fusion Middleware. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Enterprise Manager for Fusion Middleware accessible data as well as unauthorized read access to a subset of Enterprise Manager for Fusion Middleware accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Enterprise Manager for Fusion Middleware. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Affected configurations

Nvd

Vulners

Node

oracleenterprise_managerMatch11.1.1.9

oracleenterprise_managerMatch12.2.1.3

VendorProductVersionCPE
oracleenterprise_manager11.1.1.9cpe:2.3:a:oracle:enterprise_manager:11.1.1.9:*:*:*:*:*:*:*
oracleenterprise_manager12.2.1.3cpe:2.3:a:oracle:enterprise_manager:12.2.1.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	enterprise_manager	11.1.1.9	cpe:2.3:a:oracle:enterprise_manager:11.1.1.9:::::::*
oracle	enterprise_manager	12.2.1.3	cpe:2.3:a:oracle:enterprise_manager:12.2.1.3:::::::*

CNA Affected

[
  {
    "product": "Enterprise Manager for Fusion Middleware",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "11.1.1.9"
      },
      {
        "status": "affected",
        "version": "12.2.1.3"
      }
    ]
  }
]

References

www.oracle.com/security-alerts/cpuapr2021.html

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

35.4%

JSON

Related for CVE-2021-2008