Improper input validation in Oracle Agile PLM Framework - CVE-2021-35043

Vulnerability identifier: #VU60208

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-35043

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Security (AntiSamy) component in Oracle Agile PLM. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Oracle Agile PLM Framework
Oracle Insurance Policy Administration Operational Data Store for Life and Annuity
Oracle Insurance Policy Administration
Oracle Banking Platform
CloudLink
Oracle Banking Party Management
Oracle Banking Enterprise Default Management

Install updates from vendor's website.

CloudLink - update to 8.0-3.10.5.1

• https://www.oracle.com/security-alerts/cpujan2022.html

• Multiple vulnerabilities in Oracle Agile PLM Framework
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Oracle Banking Party Management
• Multiple vulnerabilities in Oracle Banking Enterprise Default Management
• Multiple vulnerabilities in Oracle Insurance Policy Administration
• Multiple vulnerabilities in Oracle Insurance Policy Administration Operational Data Store for Life and Annuity
• Multiple vulnerabilities in Dell CloudLink