CVE-2021-2392

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-239219.1An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements.CVE-2021-239225.4An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webvi CVE-2021-239238.1An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users.CVE-2021-239247.5An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files.CVE-2021-239256.1An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document CVE-2021-239269.1The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnera CVE-2021-239276.4OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request.CVE-2021-239286.1OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.CVE-2021-239296.1OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?CVE-2021-23938.1Vulnerability in the Oracle E-Records product of Oracle E-Business Suite (component: E-signatures). Supported versions that are affected are CVE-2021-239306.1OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile.CVE-2021-239316.1OX App Suite through 7.10.4 allows XSS via an inline binary file.