Permissions, Privileges, and Access Controls in Oracle Database Server - CVE-2021-2175

Vulnerability identifier: #VU52381

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-2175

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote privileged user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Database Vault in Oracle Database Server. A remote privileged user can exploit this vulnerability to gain access to sensitive information.

Oracle Database Server
IBM Emptoris Supplier Lifecycle Management
IBM Emptoris Strategic Supply Management Platform
IBM Emptoris Program Management
IBM Emptoris Contract Management
IBM Emptoris Sourcing

Install updates from vendor's website.

IBM Emptoris Supplier Lifecycle Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Strategic Supply Management Platform - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Program Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Contract Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Sourcing - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31

• https://www.oracle.com/security-alerts/cpuapr2021.html
• https://databasesecurityninja.wordpress.com/2022/02/02/cve-2021-2175-database-vault-metadata-exposure-vulnerability/

• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in IBM Emptoris Sourcing
• Multiple vulnerabilities in IBM Emptoris Program Management
• Multiple vulnerabilities in IBM Emptoris Contract Management
• Multiple vulnerabilities in IBM Emptoris Strategic Supply Management Platform
• Multiple vulnerabilities in IBM Emptoris Supplier Lifecycle Management