CVE-2021-2017
First published: Wed Jan 20 2021(Updated: )
Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Proxy User Delegation). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle User Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle User Management accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Enterprise Data Quality | =11.1.1.9.0 | |
| Oracle Enterprise Data Quality | =12.2.1.3.0 | |
| Oracle Retail Invoice Matching | =13.2 | |
| Oracle Retail Invoice Matching | =14.0 | |
| Oracle Retail Invoice Matching | =14.1 | |
| Oracle User Management | >=12.2.3<=12.2.10 | |
| Oracle User Management | =12.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Oracle User Management vulnerability?
The vulnerability ID for this Oracle User Management vulnerability is CVE-2021-2017.
What is the severity level of CVE-2021-2017?
The severity level of CVE-2021-2017 is medium (4.3).
What versions of Oracle User Management are affected by CVE-2021-2017?
Oracle User Management versions 12.1.3 and 12.2.3-12.2.10 are affected by CVE-2021-2017.
How can an attacker exploit CVE-2021-2017?
An attacker with network access via HTTP can exploit CVE-2021-2017.
Where can I find more information about CVE-2021-2017?
You can find more information about CVE-2021-2017 on the Oracle website: https://www.oracle.com/security-alerts/cpujan2021.html
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/oracle
- canonical/oracle enterprise data quality
- version/oracle enterprise data quality/11.1.1.9.0
- version/oracle enterprise data quality/12.2.1.3.0
- canonical/oracle retail invoice matching
- version/oracle retail invoice matching/13.2
- version/oracle retail invoice matching/14.0
- version/oracle retail invoice matching/14.1
- canonical/oracle user management
- version/oracle user management/12.2.3
- version/oracle user management/12.2.10
- version/oracle user management/12.1.3