Medium severity · published Jul 21, 2021
CVE-2021-2333
Vulnerability in the Oracle XML DB component of Oracle Database Server
4.9
CVSS
0.9%
EPSS
No
On KEV
Description
Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having Alter User privilege with network access via Oracle Net to compromise Oracle XML DB. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle XML DB accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XD
Xml Database · Oracle
12.1.0.2; 12.2.0.1; 19c · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-2333
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-2333
Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2021.html
More from Xml Database
7.2
CVE-2021-2329
Vulnerability in the Oracle XML DB component of Oracle Database Server
5.4
CVE-2025-30694
Vulnerability in the XML Database component of Oracle Database Server
5.3
CVE-2026-21999
Vulnerability in the XML Database component of Oracle Database Server
3.5
CVE-2024-21242
Vulnerability in the XML Database component of Oracle Database Server