Vulnerability in Oracle Agile Engineering Data Management
CVE-2021-1996
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).
Published · last modified .
CVSS v3 metric
CVSS v3 base score 2.4 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.013 (68.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 68.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Oracle Agile Engineering Data Management — versions 6.2.1.0
- Oracle Hyperion Infrastructure Technology — versions 11.1.2.4
- Oracle Siebel Ui Framework
- Oracle Weblogic Server — versions 10.3.6.0.0, 12.1.3.0.0
- Oracle Corporation Weblogic Server — versions 10.3.6.0.0, 12.1.3.0.0
References
- www.oracle.com/security-alerts/cpujan2021.html (Vendor Advisory)
Frequently asked questions
- What is CVE-2021-1996?
- CVE-2021-1996 is a low-severity vulnerability in Oracle Agile Engineering Data Management. CVSS score: 2.4/10. Published 2021-01-20.
- How severe is CVE-2021-1996?
- Low severity. CVSS v3 base score is 2.4 out of 10.