CVE-2021-2173

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

Vulnerability in the Recovery component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA Level Account privilege with network access via Oracle Net to compromise Recovery. While the vulnerability is in Recovery, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Recovery accessible data. CVSS 3.1 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-217309.8A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute for CVE-2021-217318.1A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully v CVE-2021-217327.5A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-party applications ca CVE-2021-217334.9The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the infor CVE-2021-217346.5Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. Thi CVE-2021-217356.5A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could e CVE-2021-217367.2A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management CVE-2021-217377.5A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system applicatio CVE-2021-217386.1ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, the CVE-2021-217394.6A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data CVE-2021-21744.4Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and CVE-2021-217402.4There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert