VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jan 20, 2021· Updated Jun 17, 2026

CVE-2021-2017

CVE-2021-2017

Description

Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Proxy User Delegation). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle User Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle User Management accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected products

10
  • Oracle Corporation/E Business Suitellm-fuzzy
    Range: 12.1.3, 12.2.3-12.2.10
  • Oracle Corporation/User Managementllm-fuzzy4 versions
    12.1.3, 12.2.3-12.2.10+ 3 more
    • (no CPE)range: 12.1.3, 12.2.3-12.2.10
    • (no CPE)range: 12.1.3
    • cpe:2.3:a:oracle:user_management:*:*:*:*:*:*:*:*range: >=12.2.3,<=12.2.10
    • cpe:2.3:a:oracle:user_management:12.1.3:*:*:*:*:*:*:*
  • Oracle Corporation/Enterprise Data Quality2 versions
    cpe:2.3:a:oracle:enterprise_data_quality:11.1.1.9.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:enterprise_data_quality:11.1.1.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:*
  • Oracle Corporation/Retail Invoice Matching3 versions
    cpe:2.3:a:oracle:retail_invoice_matching:13.2:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:retail_invoice_matching:13.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:retail_invoice_matching:14.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:retail_invoice_matching:14.1:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.