Login Sign Up

CVE-2021-2361

8.1 HIGH

📋 TL;DR

This vulnerability in Oracle Advanced Inbound Telephony allows authenticated attackers with network access via HTTP to perform unauthorized data manipulation and access. It affects Oracle E-Business Suite versions 12.1.1-12.1.3 and 12.2.3-12.2.10. Attackers can create, delete, or modify critical data as well as access sensitive information.

💻 Affected Systems

Products:
  • Oracle E-Business Suite - Oracle Advanced Inbound Telephony
Versions: 12.1.1-12.1.3 and 12.2.3-12.2.10
Operating Systems: All platforms running affected Oracle E-Business Suite versions
Default Config Vulnerable: ⚠️ Yes
Notes: Requires Oracle Advanced Inbound Telephony component to be installed and configured.

📦 What is this software?

Advanced Inbound Telephony by Oracle

View all CVEs affecting Advanced Inbound Telephony →

Advanced Inbound Telephony by Oracle

View all CVEs affecting Advanced Inbound Telephony →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of Oracle Advanced Inbound Telephony data including unauthorized access to all critical information and ability to modify or delete any data within the component.

🟠

Likely Case

Unauthorized data access and manipulation by authenticated users or attackers who have obtained low-privilege credentials.

🟢

If Mitigated

Limited impact if proper network segmentation, access controls, and monitoring are in place to detect unauthorized activities.

🌐 Internet-Facing: HIGH
🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Requires low-privilege authentication but is described as 'easily exploitable' by Oracle.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply Oracle Critical Patch Update for July 2021

Vendor Advisory: https://www.oracle.com/security-alerts/cpujul2021.html

Restart Required: Yes

Instructions:

1. Download the appropriate Critical Patch Update from Oracle Support. 2. Apply the patch following Oracle's patching procedures. 3. Restart affected Oracle E-Business Suite services. 4. Verify the patch was successfully applied.

🔧 Temporary Workarounds

Network Segmentation

all

Restrict network access to Oracle E-Business Suite to only trusted sources

Access Control Tightening

all

Review and minimize user privileges for Oracle Advanced Inbound Telephony access

🧯 If You Can't Patch

  • Implement strict network access controls to limit HTTP access to Oracle E-Business Suite
  • Enhance monitoring and logging for unauthorized data access or modification attempts

🔍 How to Verify

Check if Vulnerable:

Check Oracle E-Business Suite version and verify if Oracle Advanced Inbound Telephony component is installed in affected version ranges.

Check Version:

Check Oracle E-Business Suite version through Oracle Applications Manager or query database for version information.

Verify Fix Applied:

Verify that the July 2021 Critical Patch Update has been applied and check patch status in Oracle Enterprise Manager or via Oracle Support.

📡 Detection & Monitoring

Log Indicators:

  • Unusual data access patterns in Oracle E-Business Suite logs
  • Unauthorized data modification attempts in application logs

Network Indicators:

  • Unusual HTTP traffic patterns to Oracle Advanced Inbound Telephony endpoints

SIEM Query:

Search for multiple failed authentication attempts followed by successful login and data access patterns in Oracle E-Business Suite logs

📊 Metadata

CVE ID: CVE-2021-2361
CVSS v3 Score: 8.1 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published: July 21, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON