CVE-2021-2035: High severity oracle scheduler vulnerability

Published Jan 20, 2021

Updated

Vulnerability in the RDBMS Scheduler component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged attacker having Export Full Database privilege with network access via Oracle Net to compromise RDBMS Scheduler. Successful attacks of this vulnerability can result in takeover of RDBMS Scheduler. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Software

4 affected components

Oracle RDBMS Scheduler=12.1.0.2

Oracle RDBMS Scheduler=12.2.0.1

Oracle RDBMS Scheduler=18c

Oracle RDBMS Scheduler=19c

Event History

Jan 20, 2021

CVE Published

via MITRE·02:50 PM

Data Sourced

via MITRE·02:50 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-2035?

CVE-2021-2035 is considered a critical vulnerability due to its ease of exploitation and potential impact on Oracle Database Server.

How do I fix CVE-2021-2035?

To fix CVE-2021-2035, it is recommended to apply the latest security patches provided by Oracle for affected versions.

Which versions of Oracle Database Server are affected by CVE-2021-2035?

CVE-2021-2035 affects Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, and 19c.

Who can exploit CVE-2021-2035?

CVE-2021-2035 can be exploited by low-privileged attackers with Export Full Database privilege and network access via Oracle Net.

What component is vulnerable in CVE-2021-2035?

CVE-2021-2035 is a vulnerability in the RDBMS Scheduler component of Oracle Database Server.