// For flags

CVE-2021-2054

Oracle Database Procedure Improper Privilege Management Privilege Escalation Vulnerability

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Vulnerability in the RDBMS Sharding component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure, Create Any View, Create Any Trigger privilege with network access via Oracle Net to compromise RDBMS Sharding. Successful attacks of this vulnerability can result in takeover of RDBMS Sharding. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Vulnerabilidad en el componente RDBMS Sharding de Oracle Database Server. Las versiones compatibles que están afectadas son 12.2.0.1, 18c y 19c. Una vulnerabilidad fácilmente explotable permite a un atacante muy privilegiado tener el privilegio Create Any Procedure, Create Any View, Create Any Trigger con acceso de red por medio de Oracle Net comprometer a RDBMS Sharding. Los ataques con éxito de esta vulnerabilidad pueden resultar en la toma de control de RDBMS Sharding. CVSS 3.1 Puntuación Base 7.2 (Impactos de la Confidencialidad, Integridad y Disponibilidad). Vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle Database. Authentication is required to exploit this vulnerability.
The specific flaw exists within the execution of stored procedures. When executing stored procedures, the process does not properly check the caller's privileges. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from users with limited privileges.

*Credits: Emad Al-Mousa
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2020-12-09 CVE Reserved
  • 2021-01-20 CVE Published
  • 2024-09-26 CVE Updated
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
 Rdbms Sharding
Search vendor "Oracle" for product "Rdbms Sharding"
 12.2.0.1
Search vendor "Oracle" for product "Rdbms Sharding" and version "12.2.0.1"
-
Affected
Oracle
Search vendor "Oracle"
 Rdbms Sharding
Search vendor "Oracle" for product "Rdbms Sharding"
 18c
Search vendor "Oracle" for product "Rdbms Sharding" and version "18c"
-
Affected
Oracle
Search vendor "Oracle"
 Rdbms Sharding
Search vendor "Oracle" for product "Rdbms Sharding"
 19c
Search vendor "Oracle" for product "Rdbms Sharding" and version "19c"
-
Affected