CVE-2021-2337: High severity oracle database vulnerability

Published Jul 20, 2021

Updated

Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise Oracle XML DB. Successful attacks of this vulnerability can result in takeover of Oracle XML DB. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Affected Software

3 affected components

Oracle Database=12.1.0.2

Oracle Database=12.2.0.1

Oracle Database=19c

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpujul2021.html

Event History

Jul 20, 2021

CVE Published

via MITRE·10:43 PM

Data Sourced

via MITRE·10:43 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-2337?

CVE-2021-2337 is a vulnerability in the Oracle XML DB component of Oracle Database Server.

Which versions of Oracle Database Server are affected by CVE-2021-2337?

The affected versions of Oracle Database Server are 12.1.0.2, 12.2.0.1, and 19c.

What is the severity of CVE-2021-2337?

CVE-2021-2337 has a severity rating of 7.2 (high).

What privileges does an attacker need to exploit CVE-2021-2337?

The attacker needs high privileges, specifically the Create Any Procedure and Create Public Synonym privileges, with network access via Oracle.

Where can I find more information about CVE-2021-2337?

You can find more information about CVE-2021-2337 on the Oracle website: https://www.oracle.com/security-alerts/cpujul2021.html