Vulnerability in Oracle Fusion Middleware's Platform Security for Java
CVE-2021-2302

9.8CRITICAL

Key Information:

Vendor
Oracle
Status
Platform Security For Java
Vendor
CVE Published:
22 April 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 47%

Summary

A vulnerability exists in Oracle Fusion Middleware's Platform Security for Java that allows an unauthenticated attacker to gain access via HTTP. This easily exploitable flaw permits unauthorized manipulation of the system, potentially leading to a complete takeover of Oracle Platform Security for Java. Supported versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0 are at risk, making it crucial for organizations utilizing these products to apply the necessary patches and mitigate the risk.

Affected Version(s)

Platform Security for Java 11.1.1.9.0

Platform Security for Java 12.2.1.3.0

Platform Security for Java 12.2.1.4.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-2302
Created by quynhle7821

References

https://www.oracle.com/security-alerts/cpuapr2021.html
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-460/
x_refsource_MISC

EPSS Score

47% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.