Login Sign Up

CVE-2021-2102

8.2 HIGH

📋 TL;DR

This vulnerability in Oracle Complex Maintenance, Repair, and Overhaul allows unauthenticated attackers to access and modify sensitive data via a dialog box component. It affects Oracle Supply Chain users running versions 11.5.10, 12.1, and 12.2. Successful exploitation requires human interaction but can impact other connected systems.

💻 Affected Systems

Products:
  • Oracle Complex Maintenance, Repair, and Overhaul
Versions: 11.5.10, 12.1, 12.2
Operating Systems: Not specified - likely multiple
Default Config Vulnerable: ⚠️ Yes
Notes: Part of Oracle Supply Chain product suite, requires HTTP network access

📦 What is this software?

Complex Maintenance Repair And Overhaul by Oracle

View all CVEs affecting Complex Maintenance Repair And Overhaul →

Complex Maintenance Repair And Overhaul by Oracle

View all CVEs affecting Complex Maintenance Repair And Overhaul →

Complex Maintenance Repair And Overhaul by Oracle

View all CVEs affecting Complex Maintenance Repair And Overhaul →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of all Oracle Complex Maintenance, Repair, and Overhaul accessible data including unauthorized access to critical information and ability to modify or delete data across connected systems.

🟠

Likely Case

Unauthorized access to sensitive supply chain data and partial modification capabilities, potentially disrupting maintenance and repair operations.

🟢

If Mitigated

Limited impact with proper network segmentation and access controls, though some data exposure may still occur.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Easily exploitable but requires human interaction (UI-R in CVSS vector)

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply patches from Oracle Critical Patch Update January 2021

Vendor Advisory: https://www.oracle.com/security-alerts/cpujan2021.html

Restart Required: Yes

Instructions:

1. Download appropriate patches from Oracle Support 2. Apply patches following Oracle's documentation 3. Restart affected services 4. Verify patch application

🔧 Temporary Workarounds

Network Segmentation

all

Restrict network access to Oracle Complex Maintenance, Repair, and Overhaul systems

Access Control Hardening

all

Implement strict authentication and authorization controls

🧯 If You Can't Patch

  • Isolate affected systems from internet and untrusted networks
  • Implement web application firewall rules to block suspicious dialog box interactions

🔍 How to Verify

Check if Vulnerable:

Check Oracle version against affected versions (11.5.10, 12.1, 12.2) and review patch status

Check Version:

Oracle-specific version check commands vary by installation

Verify Fix Applied:

Verify patch application through Oracle patch management tools and confirm version is updated

📡 Detection & Monitoring

Log Indicators:

  • Unauthorized access attempts to dialog box components
  • Unusual data access patterns in Oracle logs

Network Indicators:

  • HTTP requests to dialog box endpoints from unexpected sources

SIEM Query:

source="oracle_logs" AND (event_type="dialog_box_access" OR component="Complex Maintenance") AND status="unauthorized"

📊 Metadata

CVE ID: CVE-2021-2102
CVSS v3 Score: 8.2 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Published: January 20, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON