Improper input validation in Primavera Unifier - CVE-2021-42575
Published: January 23, 2022
Vulnerability identifier: #VU59936
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-42575
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Platform, Data Persistence (OWASP Java HTML Sanitizer) component in Primavera Unifier. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
Affected software
Primavera Unifier
Oracle Communications Convergence
Oracle Agile PLM Framework
Oracle JDeveloper
Hyperion Planning
Oracle Commerce Platform
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
Oracle Communications Convergence
Oracle Agile PLM Framework
Oracle JDeveloper
Hyperion Planning
Oracle Commerce Platform
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
How to mitigate CVE-2021-42575
Install updates from vendor's website.
External References
Related Security Bulletins
- Multiple vulnerabilities in Primavera Unifier
- Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
- Multiple vulnerabilities in Middleware Common Libraries and Tools
- Improper input validation in Oracle Commerce Platform
- Multiple vulnerabilities in Oracle Communications Convergence
- Improper input validation in Oracle JDeveloper
- Multiple vulnerabilities in Hyperion Planning
- Multiple vulnerabilities in Oracle Agile PLM Framework