Login Sign Up

CVE-2021-2258

8.1 HIGH

📋 TL;DR

This vulnerability in Oracle Projects (part of Oracle E-Business Suite) allows authenticated attackers with low privileges to perform unauthorized data manipulation and access sensitive information via HTTP. Affected versions include 12.1.1-12.1.3 and 12.2.3-12.2.10 of Oracle E-Business Suite.

💻 Affected Systems

Products:
  • Oracle E-Business Suite - Oracle Projects module
Versions: 12.1.1-12.1.3 and 12.2.3-12.2.10
Operating Systems: All platforms running Oracle E-Business Suite
Default Config Vulnerable: ⚠️ Yes
Notes: Requires Oracle Projects component to be installed and accessible via HTTP.

📦 What is this software?

Projects by Oracle

View all CVEs affecting Projects →

Projects by Oracle

View all CVEs affecting Projects →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of Oracle Projects data including unauthorized creation, deletion, or modification of critical business data, plus unauthorized access to all sensitive information within the module.

🟠

Likely Case

Unauthorized data manipulation and access to sensitive project information by authenticated users with malicious intent.

🟢

If Mitigated

Limited impact if proper access controls, network segmentation, and monitoring are in place to detect and block unauthorized activities.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Requires low-privileged authenticated access via HTTP, making it relatively easy to exploit for attackers with valid credentials.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply Critical Patch Update for April 2021 or later

Vendor Advisory: https://www.oracle.com/security-alerts/cpuapr2021.html

Restart Required: Yes

Instructions:

1. Download the appropriate Critical Patch Update from Oracle Support. 2. Apply the patch following Oracle's patching procedures. 3. Restart affected Oracle E-Business Suite services. 4. Test functionality after patching.

🔧 Temporary Workarounds

Network Access Restriction

all

Restrict network access to Oracle E-Business Suite to only trusted IP addresses and networks.

Use firewall rules to limit access: iptables -A INPUT -p tcp --dport <port> -s <trusted_ip> -j ACCEPT

Enhanced Authentication Controls

all

Implement multi-factor authentication and strict access controls for Oracle Projects users.

Configure Oracle Access Manager or similar solutions for stronger authentication

🧯 If You Can't Patch

  • Implement strict network segmentation and firewall rules to limit access to Oracle E-Business Suite
  • Enable detailed logging and monitoring for unauthorized access attempts and data manipulation activities

🔍 How to Verify

Check if Vulnerable:

Check Oracle E-Business Suite version and installed patches via Oracle Applications Manager or querying database for version information.

Check Version:

SELECT RELEASE_NAME FROM FND_PRODUCT_GROUPS;

Verify Fix Applied:

Verify that the April 2021 Critical Patch Update or later has been applied through Oracle patch management tools.

📡 Detection & Monitoring

Log Indicators:

  • Unusual data modification patterns in Oracle Projects logs
  • Multiple failed authentication attempts followed by successful login and data access
  • Unauthorized SQL queries or data manipulation activities

Network Indicators:

  • HTTP requests to Oracle Projects endpoints from unusual IP addresses
  • Patterns of data extraction or manipulation via HTTP

SIEM Query:

source="oracle_ebs" AND (event_type="data_modification" OR event_type="unauthorized_access") AND user_privilege="low"

📊 Metadata

CVE ID: CVE-2021-2258
CVSS v3 Score: 8.1 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published: April 22, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON