CVE-2021-2335: Low severity oracle database vulnerability

Published Jul 20, 2021

Updated

Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition Data Redaction. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database - Enterprise Edition Data Redaction accessible data. CVSS 3.1 Base Score 3.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).

Affected Software

3 affected components

Oracle Database=12.1.0.2

Oracle Database=12.2.0.1

Oracle Database=19c

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpujul2021.html

Event History

Jul 20, 2021

CVE Published

via MITRE·10:43 PM

Data Sourced

via MITRE·10:43 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this Oracle Database vulnerability?

The vulnerability ID for this Oracle Database vulnerability is CVE-2021-2335.

What is the affected software for this vulnerability?

The affected software for this vulnerability is Oracle Database versions 12.1.0.2, 12.2.0.1, and 19c.

What is the severity of CVE-2021-2335?

The severity of CVE-2021-2335 is low with a severity value of 3.5.

How can the vulnerability CVE-2021-2335 be exploited?

The vulnerability CVE-2021-2335 can be exploited by a low-privileged attacker with Create Session privilege and network access.

Where can I find more information about CVE-2021-2335?

You can find more information about CVE-2021-2335 on the Oracle website: https://www.oracle.com/security-alerts/cpujul2021.html