CVE-2021-2277: High severity oracle coherence vulnerability

Published Apr 22, 2021

Updated

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected Software

5 affected components

Oracle Coherence=3.7.1.0

Oracle Coherence=12.1.3.0.0

Oracle Coherence=12.2.1.3.0

Oracle Coherence=12.2.1.4.0

Oracle Coherence=14.1.1.0.0

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpuapr2021.html

Event History

Apr 22, 2021

CVE Published

via MITRE·09:53 PM

Data Sourced

via MITRE·09:53 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2021-2277.

What is the severity level of CVE-2021-2277?

The severity level of CVE-2021-2277 is high (7.5).

Which component of Oracle Fusion Middleware is affected by CVE-2021-2277?

CVE-2021-2277 affects the Core component of Oracle Coherence.

Which versions of Oracle Coherence are affected by CVE-2021-2277?

The affected versions of Oracle Coherence are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0.

How can an attacker exploit CVE-2021-2277?

An unauthenticated attacker with network access via HTTP can exploit CVE-2021-2277.