CVE-2021-2173 — Vulnetix

CVE-2021-2173 PUBLISHED CVSS 4.099999904632568 MEDIUM

Vulnerability in the Recovery component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA Level Account privilege with network access via Oracle Net to compromise Recovery. While the vulnerability is in Recovery, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Recovery accessible data. CVSS 3.1 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).

EPSS 0.27% · 50.7th percentile

Risk Scores

CVSS 3.1

4.099999904632568

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

EPSS Score

0.27%

50.7th percentile

Affected Products

Vendor	Product	Versions
oracle	database_server	19c, 12.1.0.2, 12.2.0.1
Oracle Corporation	Database - Enterprise Edition	12.1.0.2, 18c, 19c

Exploit Intelligence

CVE-2021-2173 (github-poc)
CVE-2021-2173 (github-poc)
CVE-2021-2173 (github-poc)
CVE-2021-2173 (github-poc)
https://github.com/emad-almousa/CVE-2021-2173 (nist-nvd)
https://www.oracle.com/security-alerts/cpuapr2021.html (circl)
http://packetstormsecurity.com/files/171344/Oracle-DB-Broken-PDB-Isolation-Metadata-Exposure.html (circl)
Oracle DB Broken PDB Isolation / Metadata Exposure Vulnerability (0day-today)
Oracle DB Broken PDB Isolation / Metadata Exposure Vulnerability (0day-today)

Timeline

Apr 21, 2021 CVE Published
Apr 27, 2021 EPSS Score
Jun 30, 2021 EPSS Score
Nov 2, 2021 EPSS Score
Jan 3, 2022 EPSS Score
Jan 6, 2022 EPSS Score
Mar 6, 2022 EPSS Score
Apr 1, 2022 EPSS Score
May 8, 2022 EPSS Score
Sep 10, 2022 EPSS Score
Nov 11, 2022 EPSS Score
Jan 13, 2023 EPSS Score

References

Open in Interactive Console →