Login Sign Up

CVE-2021-2199

8.2 HIGH

📋 TL;DR

This vulnerability in Oracle iStore allows unauthenticated attackers to access sensitive data and modify some data via HTTP requests. It affects Oracle E-Business Suite versions 12.1.1-12.1.3 and 12.2.3-12.2.10, requiring user interaction for successful exploitation.

💻 Affected Systems

Products:
  • Oracle E-Business Suite iStore
Versions: 12.1.1-12.1.3 and 12.2.3-12.2.10
Operating Systems: Any OS running Oracle E-Business Suite
Default Config Vulnerable: ⚠️ Yes
Notes: Affects Shopping Cart component specifically; requires HTTP access to vulnerable instance.

📦 What is this software?

Istore by Oracle

View all CVEs affecting Istore →

Istore by Oracle

View all CVEs affecting Istore →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of all Oracle iStore accessible data including unauthorized access to critical information and unauthorized data modification.

🟠

Likely Case

Unauthorized access to sensitive customer and business data stored in iStore shopping cart systems.

🟢

If Mitigated

Limited impact with proper network segmentation and user awareness training to prevent social engineering.

🌐 Internet-Facing: HIGH - Unauthenticated network access via HTTP makes internet-facing instances particularly vulnerable.
🏢 Internal Only: MEDIUM - Internal systems still vulnerable but attack surface reduced compared to internet-facing deployments.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW - CVSS indicates low attack complexity but requires user interaction.

Requires human interaction (UI:R) meaning attacker needs to trick user into performing action.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply patches from Oracle Critical Patch Update April 2021

Vendor Advisory: https://www.oracle.com/security-alerts/cpuapr2021.html

Restart Required: Yes

Instructions:

1. Download appropriate patch from Oracle Support. 2. Apply patch following Oracle E-Business Suite patching procedures. 3. Restart affected services. 4. Test functionality.

🔧 Temporary Workarounds

Network Segmentation

linux

Restrict HTTP access to Oracle iStore instances to trusted networks only.

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_NETWORK" port protocol="tcp" port="80" accept'
firewall-cmd --reload

Web Application Firewall

all

Deploy WAF with rules to detect and block suspicious iStore shopping cart requests.

🧯 If You Can't Patch

  • Implement strict network access controls to limit HTTP access to Oracle iStore
  • Monitor for suspicious shopping cart activity and user interaction patterns

🔍 How to Verify

Check if Vulnerable:

Check Oracle E-Business Suite version and patch level against affected versions list.

Check Version:

SELECT RELEASE_NAME FROM FND_PRODUCT_GROUPS;

Verify Fix Applied:

Verify patch application via Oracle OPatch utility and check version after patching.

📡 Detection & Monitoring

Log Indicators:

  • Unusual shopping cart activity patterns
  • Multiple failed authentication attempts followed by successful access
  • Suspicious HTTP requests to iStore endpoints

Network Indicators:

  • Unusual HTTP traffic patterns to iStore shopping cart URLs
  • Requests from unexpected source IPs

SIEM Query:

source="oracle-ebs" AND (uri="/OA_HTML/*iStore*" OR uri="/OA_HTML/*ShoppingCart*") AND status>=200 AND status<300 | stats count by src_ip

📊 Metadata

CVE ID: CVE-2021-2199
CVSS v3 Score: 8.2 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Published: April 22, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON