Improper input validation in Oracle Database Server - CVE-2021-2234

Vulnerability identifier: #VU52379

CSH Severity: Medium

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-2234

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to manipulate data.

The vulnerability exists due to improper input validation within the Java VM in Oracle Database Server. A remote authenticated user can exploit this vulnerability to manipulate data.

Oracle Database Server
IBM Emptoris Supplier Lifecycle Management
IBM Emptoris Strategic Supply Management Platform
IBM Emptoris Program Management
IBM Emptoris Contract Management
IBM Emptoris Sourcing

Install updates from vendor's website.

IBM Emptoris Supplier Lifecycle Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Strategic Supply Management Platform - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Program Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Contract Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Sourcing - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31

• https://www.oracle.com/security-alerts/cpuapr2021.html

• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in IBM Emptoris Sourcing
• Multiple vulnerabilities in IBM Emptoris Program Management
• Multiple vulnerabilities in IBM Emptoris Contract Management
• Multiple vulnerabilities in IBM Emptoris Strategic Supply Management Platform
• Multiple vulnerabilities in IBM Emptoris Supplier Lifecycle Management