Improper input validation in Oracle Database Server - CVE-2021-2207

Vulnerability identifier: #VU52383

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-2207

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to manipulate data.

The vulnerability exists due to improper input validation within the Oracle Database - Enterprise Edition in Oracle Database Server. A local privileged user can exploit this vulnerability to manipulate data.

Oracle Database Server
IBM Emptoris Contract Management
IBM Emptoris Sourcing
IBM Emptoris Program Management
IBM Emptoris Supplier Lifecycle Management
IBM Emptoris Strategic Supply Management Platform

Install updates from vendor's website.

IBM Emptoris Contract Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Program Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Supplier Lifecycle Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Sourcing - addressed in versions 10.1.0.38, 10.1.1.36, 10.1.3.31
IBM Emptoris Strategic Supply Management Platform - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31

• https://www.oracle.com/security-alerts/cpuapr2021.html

• Multiple vulnerabilities in Oracle Database Server
• Improper input validation in IBM Emptoris Supplier Lifecycle Management
• Improper input validation in IBM Emptoris Program Management
• Improper input validation in IBM Emptoris Contract Management
• Improper input validation in IBM Emptoris Strategic Supply Management Platform
• Improper input validation in IBM Emptoris Sourcing