Login Sign Up

CVE-2021-2118

8.2 HIGH

📋 TL;DR

This vulnerability in Oracle Marketing (part of Oracle E-Business Suite) allows unauthenticated attackers with network access via HTTP to compromise the system. Successful attacks require human interaction (like clicking a link) and can lead to unauthorized access to critical data or modification of Oracle Marketing data. Affected versions are Oracle E-Business Suite 12.1.1-12.1.3 and 12.2.3-12.2.10.

💻 Affected Systems

Products:
  • Oracle E-Business Suite - Oracle Marketing component
Versions: 12.1.1-12.1.3 and 12.2.3-12.2.10
Operating Systems: Any OS running Oracle E-Business Suite
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects Oracle Marketing component within E-Business Suite. Requires HTTP access to the application.

📦 What is this software?

Marketing by Oracle

View all CVEs affecting Marketing →

Marketing by Oracle

View all CVEs affecting Marketing →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of Oracle Marketing data including unauthorized access to all sensitive information and ability to modify/delete marketing data, potentially impacting other connected E-Business Suite components.

🟠

Likely Case

Unauthorized access to marketing data and limited ability to modify marketing records through social engineering attacks requiring user interaction.

🟢

If Mitigated

Limited impact with proper network segmentation, strong access controls, and user awareness training about suspicious links.

🌐 Internet-Facing: HIGH - Unauthenticated network access via HTTP makes internet-facing instances extremely vulnerable to exploitation.
🏢 Internal Only: MEDIUM - Still exploitable by internal attackers or compromised internal systems, but requires user interaction.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW - Easily exploitable according to Oracle's assessment.

Requires human interaction (UI:R in CVSS), suggesting it may involve phishing or social engineering elements.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply patches from Oracle Critical Patch Update January 2021

Vendor Advisory: https://www.oracle.com/security-alerts/cpujan2021.html

Restart Required: Yes

Instructions:

1. Download appropriate patches from Oracle Support. 2. Apply patches to affected Oracle E-Business Suite instances. 3. Restart application services. 4. Test functionality.

🔧 Temporary Workarounds

Network Segmentation

linux

Restrict HTTP access to Oracle Marketing component to trusted networks only

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_NETWORK" port protocol="tcp" port="80" accept'
firewall-cmd --reload

Web Application Firewall

all

Deploy WAF with rules to detect and block exploitation attempts

🧯 If You Can't Patch

  • Implement strict network access controls to limit HTTP access to Oracle Marketing
  • Deploy web application firewall with custom rules and conduct user awareness training about phishing risks

🔍 How to Verify

Check if Vulnerable:

Check Oracle E-Business Suite version and installed patches against Oracle Critical Patch Update January 2021 advisory

Check Version:

SELECT RELEASE_NAME FROM FND_PRODUCT_GROUPS;

Verify Fix Applied:

Verify patch installation via Oracle OPatch utility and confirm version is no longer in affected range

📡 Detection & Monitoring

Log Indicators:

  • Unusual HTTP requests to Oracle Marketing endpoints
  • Multiple failed authentication attempts followed by successful marketing data access

Network Indicators:

  • HTTP traffic to Oracle Marketing from unexpected sources
  • Patterns suggesting social engineering or phishing campaigns

SIEM Query:

source="oracle-ebs-logs" AND (uri="*/marketing/*" OR component="Marketing") AND status>=200 AND user_agent="suspicious"

📊 Metadata

CVE ID: CVE-2021-2118
CVSS v3 Score: 8.2 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Published: January 20, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON