Vulnerabilities > CVE-2021-2477 - Unspecified vulnerability in Oracle Applications Framework

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

network

low complexity

oracle

NVD

Published: 2021-10-20

Updated: 2021-10-26

Summary

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Session Management). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications Framework. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerable Configurations

Part	Description	Count
Application	Oracle Oracle Applications Framework 12.1.3 Oracle Applications Framework 12.2.3 Oracle Applications Framework 12.2.4 Oracle Applications Framework 12.2.5 Oracle Applications Framework 12.2.6 Oracle Applications Framework 12.2.7 Oracle Applications Framework 12.2.8 Oracle Applications Framework 12.2.9 Oracle Applications Framework 12.2.10	9

References

https://www.oracle.com/security-alerts/cpuoct2021.html