CVE-2021-2054

Description

Vulnerability in the RDBMS Sharding component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure, Create Any View, Create Any Trigger privilege with network access via Oracle Net to compromise RDBMS Sharding. Successful attacks of this vulnerability can result in takeover of RDBMS Sharding. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

Oracle Corporation / Database - Enterprise Edition12.2.0.1 – 12.2.0.1
Oracle Corporation / Database - Enterprise Edition18c – 18c
Oracle Corporation / Database - Enterprise Edition19c – 19c

References

VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2021.html
VENDOR_ADVISORYhttps://www.zerodayinitiative.com/advisories/ZDI-21-083/