CVE-2021-2338

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing Stand-Alone). Supported versions that are affected are 21.5 and Prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Oracle Corporation	Siebel Apps - Marketing	21.5 and Prior

References

https://www.oracle.com/security-alerts/cpujul2021.htmlPatch, Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2021.htmlPatch, Vendor Advisory

Timeline

Published: Jul 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-233807.3This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certa CVE-2021-233819.8This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrar CVE-2021-233827.5The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation()CVE-2021-233839.8The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates comi CVE-2021-233845.4The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when CVE-2021-233856.1This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is po CVE-2021-233866.5This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network p CVE-2021-233876.1The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the CVE-2021-233885.3The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validat CVE-2021-233899.8The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.CVE-2021-23394.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prio CVE-2021-233909.8The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.