CVE-2021-2234: Medium severity oracle database vulnerability

Published Apr 22, 2021

Updated

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).

Affected Software

4 affected components

Oracle Database Server=12.1.0.2

Oracle Database Server=12.2.0.1

Oracle Database Server=18c

Oracle Database Server=19c

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpuapr2021.html

Event History

Apr 22, 2021

CVE Published

via MITRE·09:53 PM

Data Sourced

via MITRE·09:53 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-2234?

CVE-2021-2234 is a vulnerability in the Java VM component of Oracle Database Server that affects versions 12.1.0.2, 12.2.0.1, 18c, and 19c.

What is the severity of CVE-2021-2234?

CVE-2021-2234 has a severity rating of 5.3 (Medium).

How can an attacker exploit CVE-2021-2234?

An attacker with low privileges and Create Session privilege, along with network access via Oracle Net, can exploit CVE-2021-2234 to compromise the Java VM.

Which versions of Oracle Database Server are affected by CVE-2021-2234?

CVE-2021-2234 affects Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, and 19c.

Where can I find more information about CVE-2021-2234?

More information about CVE-2021-2234 can be found on the Oracle Security Alerts page: https://www.oracle.com/security-alerts/cpuapr2021.html