CVE-2021-2348: Medium severity oracle commerce vulnerability

Published Jul 20, 2021

Updated

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is 11.3.1.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected Software

2 affected components

Oracle Commerce Experience Manager=11.3.1.5

Oracle Commerce Guided Search=11.3.1.5

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpujul2021.html

Event History

Jul 20, 2021

CVE Published

via MITRE·10:43 PM

Data Sourced

via MITRE·10:43 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-2348?

CVE-2021-2348 is a vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce.

What is the severity of CVE-2021-2348?

The severity of CVE-2021-2348 is medium with a CVSS score of 4.3.

How does CVE-2021-2348 affect Oracle Commerce Experience Manager?

CVE-2021-2348 affects Oracle Commerce Experience Manager version 11.3.1.5.

How does CVE-2021-2348 affect Oracle Commerce Guided Search?

CVE-2021-2348 affects Oracle Commerce Guided Search version 11.3.1.5.

How can the CVE-2021-2348 vulnerability be exploited?

The CVE-2021-2348 vulnerability can be exploited by a low privileged attacker with network access via HTTP.