Back to the CVE list
CVE-2021-2351

Broken cryptographic algorithm in Oracle Advanced Networking Option

CVSS score

8.3

EPSS probability

%2.4

Risk score

0.2

Published

5 y ago

OverviewPublic Exploits (4)NewsroomVulnerability Timeline
Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-2351 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-2351 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1oracleadvanced networking option View
2oracleadvanced networking option View
3oracleadvanced networking option View
4oracleagile engineering data management View
5oracleagile product lifecycle management View
6oracleagile product lifecycle management for process View
7oracleagile product lifecycle management for process View
8oracleairlines data model View
9oracleairlines data model View
10oracleapplication performance management View
11oracleapplication performance management View
12oracleapplication testing suite View
13oracleargus analytics View
14oracleargus analytics View
15oracleargus analytics View
16oracleargus insight View
17oracleargus insight View
18oracleargus insight View
19oracleargus mart View
20oracleargus mart View
21oracleargus mart View
22oracleargus safety View
23oracleargus safety View
24oracleargus safety View
25oraclebanking apis View
26oraclebanking apis View
27oraclebanking apis View
28oraclebanking apis View
29oraclebanking apis View
30oraclebanking digital experience View
31oraclebanking digital experience View
32oraclebanking digital experience View
33oraclebanking digital experience View
34oraclebanking digital experience View
35oraclebanking digital experience View
36oraclebanking enterprise default management View
37oraclebanking enterprise default management View
38oraclebanking platform View
39oraclebanking platform View
40oraclebanking platform View
41oraclebig data spatial and graph View
42oracleblockchain platform View
43oracleclinical View
44oracleclinical View
45oraclecommerce platform View
46oraclecommerce platform View
47oraclecommerce platform View
48oraclecommunications application session controller View
49oraclecommunications billing and revenue management View
50oraclecommunications billing and revenue management View
51oraclecommunications calendar server View
52oraclecommunications contacts server View
53oraclecommunications convergent charging controller View
54oraclecommunications convergent charging controller View
55oraclecommunications data model View
56oraclecommunications data model View
57oraclecommunications data model View
58oraclecommunications data model View
59oraclecommunications data model View
60oraclecommunications design studio View
61oraclecommunications design studio View
62oraclecommunications design studio View
63oraclecommunications design studio View
64oraclecommunications diameter intelligence hub View
65oraclecommunications ip service activator View
66oraclecommunications metasolv solution View
67oraclecommunications network charging and control View
68oraclecommunications network charging and control View
69oraclecommunications network integrity View
70oraclecommunications network integrity View
71oraclecommunications pricing design center View
72oraclecommunications pricing design center View
73oraclecommunications services gatekeeper View
74oraclecommunications session report manager View
75oraclecommunications session route manager View
76oracledata integrator View
77oracledata integrator View
78oracledemantra demand management View
79oracledocumaker View
80oracledocumaker View
81oracledocumaker View
82oracleenterprise data quality View
83oracleenterprise data quality View
84oracleenterprise manager base platform View
85oracleenterprise manager base platform View
86oracleenterprise manager ops center View
87oraclefinancial services analytical applications infrastructure View
88oraclefinancial services behavior detection platform View
89oraclefinancial services behavior detection platform View
90oraclefinancial services behavior detection platform View
91oraclefinancial services enterprise case management View
92oraclefinancial services enterprise case management View
93oraclefinancial services enterprise case management View
94oraclefinancial services foreign account tax compliance act management View
95oraclefinancial services foreign account tax compliance act management View
96oraclefinancial services foreign account tax compliance act management View
97oraclefinancial services model management and governance View
98oraclefinancial services trade-based anti money laundering View
99oraclefinancial services trade-based anti money laundering View
100oracleflexcube investor servicing View
101oracleflexcube investor servicing View
102oracleflexcube investor servicing View
103oracleflexcube investor servicing View
104oracleflexcube investor servicing View
105oracleflexcube investor servicing View
106oracleflexcube private banking View
107oracleflexcube private banking View
108oraclefusion middleware View
109oraclefusion middleware View
110oraclegoldengate View
111oraclegoldengate View
112oraclegoldengate application adapters View
113oraclegraph server and client View
114oraclehealth sciences clinical development analytics View
115oraclehealth sciences inform crf submit View
116oraclehealth sciences information manager View
117oraclehealth sciences information manager View
118oraclehealthcare data repository View
119oraclehealthcare data repository View
120oraclehealthcare data repository View
121oraclehealthcare foundation View
122oraclehealthcare foundation View
123oraclehealthcare foundation View
124oraclehealthcare translational research View
125oraclehospitality inventory management View
126oraclehospitality inventory management View
127oraclehospitality opera 5 View
128oraclehospitality reporting and analytics View
129oraclehospitality suite8 View
130oraclehospitality suite8 View
131oraclehospitality suite8 View
132oraclehospitality suite8 View
133oraclehospitality suite8 View
134oraclehyperion infrastructure technology View
135oracleilearning View
136oracleilearning View
137oracleinstantis enterprisetrack View
138oracleinstantis enterprisetrack View
139oracleinstantis enterprisetrack View
140oracleinsurance data gateway View
141oracleinsurance data gateway View
142oracleinsurance data gateway View
143oracleinsurance data gateway View
144oracleinsurance data gateway View
145oracleinsurance insbridge rating and underwriting View
146oracleinsurance insbridge rating and underwriting View
147oracleinsurance policy administration View
148oracleinsurance policy administration View
149oracleinsurance policy administration View
150oracleinsurance policy administration View
151oracleinsurance policy administration View
152oracleinsurance rules palette View
153oracleinsurance rules palette View
154oracleinsurance rules palette View
155oracleinsurance rules palette View
156oracleinsurance rules palette View
157oraclejd edwards enterpriseone tools View
158oracleoss support tools View
159oraclepeoplesoft enterprise peopletools View
160oraclepeoplesoft enterprise peopletools View
161oraclepeoplesoft enterprise peopletools View
162oraclepolicy automation View
163oracleprimavera analytics View
164oracleprimavera analytics View
165oracleprimavera analytics View
166oracleprimavera data warehouse View
167oracleprimavera data warehouse View
168oracleprimavera data warehouse View
169oracleprimavera gateway View
170oracleprimavera gateway View
171oracleprimavera gateway View
172oracleprimavera gateway View
173oracleprimavera p6 enterprise project portfolio management View
174oracleprimavera p6 enterprise project portfolio management View
175oracleprimavera p6 enterprise project portfolio management View
176oracleprimavera p6 enterprise project portfolio management View
177oracleprimavera p6 professional project management View
178oracleprimavera p6 professional project management View
179oracleprimavera p6 professional project management View
180oracleprimavera p6 professional project management View
181oracleprimavera unifier View
182oracleprimavera unifier View
183oracleprimavera unifier View
184oracleprimavera unifier View
185oracleprimavera unifier View
186oracleproduct lifecycle analytics View
187oraclerapid planning View
188oraclereal user experience insight View
189oraclereal user experience insight View
190oracleretail analytics View
191oracleretail assortment planning View
192oracleretail back office View
193oracleretail central office View
194oracleretail customer insights View
195oracleretail extract transform and load View
196oracleretail financial integration View
197oracleretail financial integration View
198oracleretail financial integration View
199oracleretail financial integration View
200oracleretail integration bus View
Total affected vendors: 1|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
8.3CVSS V31HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HNVD
7.5CVSS V31HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HNVD
5.1CVSS V2—AV:N/AC:H/Au:N/C:P/I:P/A:PNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

8 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
reference

Yama veya çözüm referansı

Open source
reference

Yama veya çözüm referansı

Open source
reference

Yama veya çözüm referansı

Open source
reference

Yama veya çözüm referansı

Open source
Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

CVE-2021-2351 : the database holds 4 public PoC/exploit sources for it. For direct links to the sources, open the Public Exploits tab.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-2351 is associated with the following CWEs:

CWE-327: Common Weakness Enumeration Entry CWE-327CWE-384: Common Weakness Enumeration Entry CWE-384

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-2351 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekiyor

Official Sources and Advisories

https://www.oracle.com/security-alerts/cpuapr2022.htmlpatchhttps://www.oracle.com/security-alerts/cpujan2022.htmlpatchhttps://www.oracle.com/security-alerts/cpujan2023.htmlvendor-advisoryhttps://www.oracle.com/security-alerts/cpujul2021.htmlpatchhttps://www.oracle.com/security-alerts/cpujul2022.htmlvendor-advisoryhttps://www.oracle.com/security-alerts/cpuoct2021.htmlpatch

CVSS Vector Radar Chart

8.3 / 10
Attack VectorNetworkComplexityHighPrivilegesNoneUser Interact.RequiredConfidentialityHighIntegrityHighAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone required
User Interaction—
Confidentiality (Gizlilik)High
Integrity (Bütünlük)High
Availability (Erişilebilirlik)High

Yama doğrulandı

8 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

O
oracle logo
oracle

Weakness Type (CWE & CAPEC)

CWE-327 CWE-384

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2021-2351"