Improper input validation in Oracle Communications Cloud Native Core Policy - CVE-2021-28170

Vulnerability identifier: #VU62513

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-28170

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Policy (Jakarta) component in Oracle Communications Cloud Native Core Policy. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Oracle Communications Cloud Native Core Policy
IBM Sterling Control Center
Cloudera Data Platform Private Cloud Base for IBM
Oracle Banking Liquidity Management
Oracle Commerce Platform
Oracle WebLogic Server
Fuse
watsonx.data
Db2 Big SQL

Install updates from vendor's website.

Cloudera Data Platform Private Cloud Base for IBM - update to 7.1.9.3 HF2
watsonx.data - update to 2.0.2
Db2 Big SQL - update to 7.6.4
Fuse - update to 7.10.0

• https://www.oracle.com/security-alerts/cpuapr2022.html

• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle WebLogic Server
• Improper input validation in IBM Sterling Control Center
• Multiple vulnerabilities in IBM Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Multiple vulnerabilities in Oracle Commerce Platform
• Multiple vulnerabilities in Fuse 7.10
• Multiple vulnerabilities in IBM Big SQL on Cloud Pak for Data
• IBM watsonx.data update for Eclipse EE4J Jakarta Expression Language
• Multiple vulnerabilities in Oracle Banking Liquidity Management