Improper input validation in Oracle Database Server - CVE-2021-2173

Vulnerability identifier: #VU52380

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2021-2173

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Recovery in Oracle Database Server. A remote privileged user can exploit this vulnerability to gain access to sensitive information.

Oracle Database Server
IBM Emptoris Supplier Lifecycle Management
IBM Emptoris Strategic Supply Management Platform
IBM Emptoris Program Management
IBM Emptoris Contract Management
IBM Emptoris Sourcing

Install updates from vendor's website.

IBM Emptoris Supplier Lifecycle Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Strategic Supply Management Platform - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Program Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Contract Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Sourcing - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31

• Exploit #5527 - CVE-2021-2173 – PDB Isolation is broken through metadata exposure (June 6, 2021)

• https://www.oracle.com/security-alerts/cpuapr2021.html

• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in IBM Emptoris Sourcing
• Multiple vulnerabilities in IBM Emptoris Program Management
• Multiple vulnerabilities in IBM Emptoris Contract Management
• Multiple vulnerabilities in IBM Emptoris Strategic Supply Management Platform
• Multiple vulnerabilities in IBM Emptoris Supplier Lifecycle Management