CVE-2021-2303: Oracle OSS Support Tools Diagnostic Assistant XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Oracle OSS Support Tools. Authentication is required to exploit this vulnerability. The specific flaw exists within the Diagnostic Assistant component. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the service account.
Other sources
Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant). The supported version that is affected is Prior to 2.12.41. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise OSS Support Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all OSS Support Tools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-2303.
What is the severity of CVE-2021-2303?
The severity of CVE-2021-2303 is medium (4.9).
Which software is affected by CVE-2021-2303?
CVE-2021-2303 affects Oracle OSS Support Tools version up to 2.12.41.
What is the required authentication to exploit CVE-2021-2303?
Authentication is required to exploit CVE-2021-2303.
How can I fix the vulnerability CVE-2021-2303?
To fix CVE-2021-2303, Oracle OSS Support Tools should be updated to a version beyond 2.12.41.