CVE-2021-2396

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-239608.8Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This CVE-2021-239617.4Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hos CVE-2021-239628.8Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerabilit CVE-2021-239634.3When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to CVE-2021-239648.8Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corr CVE-2021-239658.8Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume CVE-2021-239684.3If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation re CVE-2021-239694.3As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is CVE-2021-23979.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2021-239706.5Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code. This vulnerab CVE-2021-239716.5When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy. This would have po CVE-2021-239728.8One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.com'. To mitigate this