CVE-2021-2025

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 20, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-202504.3A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on theCVE-2021-202515.9A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if speCVE-2021-202526.5A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested dateCVE-2021-202536.7A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilCVE-2021-202546.8A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that perCVE-2021-202555.5A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while pCVE-2021-202565.3A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local attacker with view_hCVE-2021-202576.5An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in procCVE-2021-202597.8A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attackeCVE-2021-20268.2Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are CVE-2021-202607.8A flaw was found in the Foreman project. The Datacenter plugin exposes the password through the API to an authenticated local attacker with CVE-2021-202616.4A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue
CVE-2021-2025: High severity, CVSS 8.2 | Vulnix