CVE-2021-2175

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-2175
Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any View, Select Any View privilege with network access via Oracle Net to compromise Database Vault. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Database Vault accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

2.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://packetstormsecurity.com/files/170373/Oracle-Database-Vault-Metadata-Exposure.html Exploit Third Party Advisory VDB Entry
https://databasesecurityninja.wordpress.com/2022/02/02/cve-2021-2175-database-vault-metadata-exposure-vulnerability/ Exploit Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2021.html Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:oracle:database_server:12.1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:*
History

27 Feb 2023, 17:24

Type Values Removed Values Added
References (MISC) http://packetstormsecurity.com/files/170373/Oracle-Database-Vault-Metadata-Exposure.html - (MISC) http://packetstormsecurity.com/files/170373/Oracle-Database-Vault-Metadata-Exposure.html - Exploit, Third Party Advisory, VDB Entry

05 Jan 2023, 17:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/170373/Oracle-Database-Vault-Metadata-Exposure.html -

10 Feb 2022, 07:40

Type Values Removed Values Added
References (MISC) https://databasesecurityninja.wordpress.com/2022/02/02/cve-2021-2175-database-vault-metadata-exposure-vulnerability/ - (MISC) https://databasesecurityninja.wordpress.com/2022/02/02/cve-2021-2175-database-vault-metadata-exposure-vulnerability/ - Exploit, Third Party Advisory

03 Feb 2022, 00:15

Type Values Removed Values Added
References
  • (MISC) https://databasesecurityninja.wordpress.com/2022/02/02/cve-2021-2175-database-vault-metadata-exposure-vulnerability/ -

23 Apr 2021, 19:03

Type Values Removed Values Added
CPE cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:*
cpe:2.3:a:oracle:database_server:12.1.0.2:*:*:*:*:*:*:*
References (MISC) https://www.oracle.com/security-alerts/cpuapr2021.html - (MISC) https://www.oracle.com/security-alerts/cpuapr2021.html - Patch, Vendor Advisory
CVSS v2 : unknown
v3 : 2.7 		v2 : 4.0
v3 : 2.7
CWE NVD-CWE-noinfo

22 Apr 2021, 23:32

Type Values Removed Values Added
New CVE
Information

Published : 2021-04-22 22:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-2175

Mitre link : CVE-2021-2175

CVE.ORG link : CVE-2021-2175

JSON object : View

Products Affected

oracle

  • database_server
CWE
NVD-CWE-noinfo