cnvd - cnvd-2021-07110

cnvd-2021-07110

Vulnerability from cnvd

Title: Oracle Outside In Technology存在未明漏洞（CNVD-2021-07110）

Description:

Oracle Outside In Technology是一套软件开发工具包 (SDK)，为开发人员提供了一个提取、规范化、清理、转换和查看600多种非结构化文件格式的内容的综合解决方案。

Oracle Outside In Technology 8.5.4、8.5.5中的Outside In Filters组件存在安全漏洞。攻击者可利用该漏洞对关键数据或所有Oracle Outside In Technology可访问数据的未经授权的创建，删除或修改访问，以及对Oracle Outside In Technology可访问数据的子集的未经授权的读取访问等。

Severity: 高

Patch Name: Oracle Outside In Technology存在未明漏洞（CNVD-2021-07110）的补丁

Patch Description:

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.oracle.com/security-alerts/cpujan2021.html

Reference: https://www.oracle.com/security-alerts/cpujan2021.html

Impacted products

Name
['Oracle Oracle Outside In Technology 8.5.4', 'Oracle Outside In Technology 8.5.5']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-2067",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-2067"
    }
  },
  "description": "Oracle Outside In Technology\u662f\u4e00\u5957\u8f6f\u4ef6\u5f00\u53d1\u5de5\u5177\u5305 (SDK)\uff0c\u4e3a\u5f00\u53d1\u4eba\u5458\u63d0\u4f9b\u4e86\u4e00\u4e2a\u63d0\u53d6\u3001\u89c4\u8303\u5316\u3001\u6e05\u7406\u3001\u8f6c\u6362\u548c\u67e5\u770b600\u591a\u79cd\u975e\u7ed3\u6784\u5316\u6587\u4ef6\u683c\u5f0f\u7684\u5185\u5bb9\u7684\u7efc\u5408\u89e3\u51b3\u65b9\u6848\u3002\n\nOracle Outside In Technology 8.5.4\u30018.5.5\u4e2d\u7684Outside In Filters\u7ec4\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u5173\u952e\u6570\u636e\u6216\u6240\u6709Oracle Outside In Technology\u53ef\u8bbf\u95ee\u6570\u636e\u7684\u672a\u7ecf\u6388\u6743\u7684\u521b\u5efa\uff0c\u5220\u9664\u6216\u4fee\u6539\u8bbf\u95ee\uff0c\u4ee5\u53ca\u5bf9Oracle Outside In Technology\u53ef\u8bbf\u95ee\u6570\u636e\u7684\u5b50\u96c6\u7684\u672a\u7ecf\u6388\u6743\u7684\u8bfb\u53d6\u8bbf\u95ee\u7b49\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.oracle.com/security-alerts/cpujan2021.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-07110",
  "openTime": "2021-01-19",
  "patchDescription": "Oracle Outside In Technology\u662f\u4e00\u5957\u8f6f\u4ef6\u5f00\u53d1\u5de5\u5177\u5305 (SDK)\uff0c\u4e3a\u5f00\u53d1\u4eba\u5458\u63d0\u4f9b\u4e86\u4e00\u4e2a\u63d0\u53d6\u3001\u89c4\u8303\u5316\u3001\u6e05\u7406\u3001\u8f6c\u6362\u548c\u67e5\u770b600\u591a\u79cd\u975e\u7ed3\u6784\u5316\u6587\u4ef6\u683c\u5f0f\u7684\u5185\u5bb9\u7684\u7efc\u5408\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nOracle Outside In Technology 8.5.4\u30018.5.5\u4e2d\u7684Outside In Filters\u7ec4\u4ef6\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bf9\u5173\u952e\u6570\u636e\u6216\u6240\u6709Oracle Outside In Technology\u53ef\u8bbf\u95ee\u6570\u636e\u7684\u672a\u7ecf\u6388\u6743\u7684\u521b\u5efa\uff0c\u5220\u9664\u6216\u4fee\u6539\u8bbf\u95ee\uff0c\u4ee5\u53ca\u5bf9Oracle Outside In Technology\u53ef\u8bbf\u95ee\u6570\u636e\u7684\u5b50\u96c6\u7684\u672a\u7ecf\u6388\u6743\u7684\u8bfb\u53d6\u8bbf\u95ee\u7b49\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Oracle Outside In Technology\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2021-07110\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Oracle Oracle Outside In Technology 8.5.4",
      "Oracle Outside In Technology 8.5.5"
    ]
  },
  "referenceLink": "https://www.oracle.com/security-alerts/cpujan2021.html",
  "serverity": "\u9ad8",
  "submitTime": "2021-01-20",
  "title": "Oracle Outside In Technology\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2021-07110\uff09"
}

CVE-2021-2067 (GCVE-0-2021-2067)

Vulnerability from cvelistv5

Published

2021-01-20 14:50

Modified

2024-09-26 18:21

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

CWE

Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology.

Summary

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.4 and 8.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).

References

▼	URL	Tags
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Oracle Corporation	Outside In Technology	Version: 8.5.4 Version: 8.5.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:32:02.689Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-2067",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T18:13:21.571437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T18:21:55.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Outside In Technology",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.5.4"
            },
            {
              "status": "affected",
              "version": "8.5.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.4 and 8.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-20T14:50:07",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-2067",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Outside In Technology",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "8.5.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8.5.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.4 and 8.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "8.6",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-2067",
    "datePublished": "2021-01-20T14:50:07",
    "dateReserved": "2020-12-09T00:00:00",
    "dateUpdated": "2024-09-26T18:21:55.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted