CVE-2021-2337

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise Oracle XML DB. Successful attacks of this vulnerability can result in takeover of Oracle XML DB. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-233709.8This affects the package swiper before 6.5.1.CVE-2021-233717.5This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.CVE-2021-233727.5All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandl CVE-2021-233739.8All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.CVE-2021-233749.8This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an atta CVE-2021-233759.8This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker CVE-2021-233769.8This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for a CVE-2021-233779.8This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an CVE-2021-233789.8This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker CVE-2021-233799.8This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arb CVE-2021-23386.1Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing Stand-Alone). Supported versions that CVE-2021-233807.3This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certa