Vulnerability · Published Apr 22, 2021 · Assigned by oracle

CVE-2021-2303

Medium 4.9

In plain English

A medium-severity security flaw in OSS Support Tools from Oracle Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)1.5%top 26.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant). The supported version that is affected is Prior to 2.12.41. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise OSS Support Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all OSS Support Tools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

Affected products (as reported)

Vendor	Product	Versions
Oracle Corporation	OSS Support Tools	unspecified – before 2.12.41

References

https://www.oracle.com/security-alerts/cpuapr2021.html x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-458/ x_refsource_MISC