Improper input validation in Oracle Database Server - CVE-2021-2329

Vulnerability identifier: #VU55046

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-2329

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Oracle XML DB in Oracle Database Server. A remote privileged user can exploit this vulnerability to execute arbitrary code.

Oracle Database Server
IBM Emptoris Sourcing
IBM Emptoris Supplier Lifecycle Management
IBM Emptoris Strategic Supply Management Platform

Install updates from vendor's website.

IBM Emptoris Sourcing - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Supplier Lifecycle Management - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31
IBM Emptoris Strategic Supply Management Platform - addressed in versions 10.1.0.39, 10.1.1.36, 10.1.3.31

• https://www.oracle.com/security-alerts/cpujul2021.html

• Multiple vulnerabilities in Oracle Database Server
• Remote code execution in IBM Emptoris Strategic Supply Management Platform
• Remote code execution in IBM Emptoris Supplier Lifecycle Management
• Remote code execution in IBM Emptoris Sourcing