Login Sign Up

CVE-2021-2482

8.1 HIGH

📋 TL;DR

This vulnerability in Oracle Payables allows authenticated attackers with low privileges to perform unauthorized data manipulation and access sensitive information via HTTP. It affects Oracle E-Business Suite versions 12.1.1 through 12.1.3. Attackers can create, delete, or modify critical data and access confidential information.

💻 Affected Systems

Products:
  • Oracle E-Business Suite - Oracle Payables
Versions: 12.1.1-12.1.3
Operating Systems: All supported platforms for Oracle E-Business Suite
Default Config Vulnerable: ⚠️ Yes
Notes: Requires Oracle Payables component with Invoice Approvals functionality enabled.

📦 What is this software?

Payables by Oracle

View all CVEs affecting Payables →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of Oracle Payables data including unauthorized access to all financial data, manipulation of invoices and approvals, and potential financial fraud.

🟠

Likely Case

Unauthorized access to sensitive financial data and manipulation of invoice approval processes, potentially leading to fraudulent payments.

🟢

If Mitigated

Limited impact with proper network segmentation, strong authentication controls, and monitoring of privileged account activities.

🌐 Internet-Facing: HIGH
🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Requires low-privileged authenticated access via HTTP. No public exploit code available as of knowledge cutoff.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply October 2021 Critical Patch Update or later

Vendor Advisory: https://www.oracle.com/security-alerts/cpuoct2021.html

Restart Required: Yes

Instructions:

1. Download October 2021 Critical Patch Update from Oracle Support. 2. Apply patch to affected Oracle E-Business Suite instances. 3. Restart application services. 4. Test functionality.

🔧 Temporary Workarounds

Network Segmentation

all

Restrict network access to Oracle E-Business Suite to trusted IP addresses only

Privilege Reduction

all

Review and minimize user privileges in Oracle Payables, especially for invoice approval functions

🧯 If You Can't Patch

  • Implement strict network access controls to limit HTTP access to Oracle Payables
  • Enable detailed logging and monitoring for invoice approval activities and review regularly

🔍 How to Verify

Check if Vulnerable:

Check Oracle E-Business Suite version and verify if October 2021 CPU has been applied

Check Version:

Check Oracle E-Business Suite version through application administration interface or database queries

Verify Fix Applied:

Verify patch application via Oracle OPatch utility and confirm version is post-October 2021 CPU

📡 Detection & Monitoring

Log Indicators:

  • Unusual invoice approval activities
  • Multiple failed login attempts followed by successful access
  • Unauthorized data access patterns in audit logs

Network Indicators:

  • HTTP requests to Invoice Approvals endpoints from unexpected sources
  • Unusual traffic patterns to Oracle Payables

SIEM Query:

source="oracle-ebs" AND (event_type="invoice_approval" OR component="payables") AND user_privilege="low" AND action IN ("create","delete","modify")

📊 Metadata

CVE ID: CVE-2021-2482
CVSS v3 Score: 8.1 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published: October 20, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON