CVE-2021-2252

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Loan Details, Loan Accounting Events). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Loans. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Loans accessible data as well as unauthorized access to critical data or complete access to all Oracle Loans accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-225216.7A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting version 2020 Update 1 CVE-2021-225227.1Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier v CVE-2021-225237.6XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. The vulner CVE-2021-225244.9Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 CVE-2021-225255.5This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1 CVE-2021-225266.1Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 CVE-2021-225277.5Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 CVE-2021-225285.4Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 CVE-2021-225295.5A vulnerability identified in NetIQ Advance Authentication that leaks sensitive server information. This issue affects NetIQ Advance Authent CVE-2021-22539.1Vulnerability in the Oracle Advanced Supply Chain Planning product of Oracle Supply Chain (component: Core). Supported versions that are aff CVE-2021-225309.9A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API CVE-2021-225316.1A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability.