CVE-2021-2018: Vulnerability in the Advanced Networking Option component of Oracle Database Server

Description

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: CVE-2021-2018 affects Windows platform only. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)1.5% · higher than 73% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

WS

WebLogic Server · Oracle

12.2.1.3.0 · source: NVD

AA

Adaptive Access Manager · Oracle

11.1.2.3.0 · source: NVD

AN

Advanced Networking Option · Oracle

18c; 19c · source: NVD

DI

Data Integrator · Oracle

11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0 · source: NVD

EM

Enterprise Manager For Fusion Applications · Oracle

13.3.0.0 · source: NVD

HS

Hospitality Simphony · Oracle

18.2.7.2; 19.1.3 · source: NVD