Critical severity · published Apr 22, 2021
CVE-2021-2221
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client)
9.6
CVSS
2%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affected is 5.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Secure Global Desktop. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Secure Global Desktop, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Secure Global Desktop.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
Secure Global Desktop · Oracle
5.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-2221
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-2221
Patch
https://www.oracle.com/security-alerts/cpuapr2021.html
More from Secure Global Desktop
9.0
CVE-2021-40438
mod_proxy SSRF
10.0
CVE-2021-2248
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server)
10.0
CVE-2021-2177
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Gateway)
9.9
CVE-2021-2447
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server)
9.8
CVE-2019-3822
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow