Skip to main content

Commerce Experience Manager CVE-2021-2346

MEDIUM
2021-07-21 secalert_us@oracle.com
Oracle Authentication Bypass Commerce Experience Manager Commerce Guided Search
5.4
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 21, 2021 - 15:15 cve.org
MEDIUM 5.4

DescriptionCVE.org

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is 11.3.1.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is 11.3.1.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Affected products include: Oracle Commerce Experience Manager, Oracle Commerce Guided Search.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Commerce Experience Manager

View all
CVE-2026-61146 CRITICAL
9.9 Jul 21

Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible when a low-privil
CVE-2026-61161 CRITICAL
9.8 Jul 21

Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Co
CVE-2026-61145 CRITICAL
9.8 Jul 21

Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System
CVE-2026-70995 CRITICAL
9.8 Aug 18

Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Co
CVE-2026-70998 CRITICAL
9.3 Aug 18

Unauthenticated authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Appl
CVE-2026-70984 CRITICAL
9.1 Aug 18

Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Conte
CVE-2026-70981 CRITICAL
9.1 Aug 18

Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manag
CVE-2026-70977 CRITICAL
9.1 Aug 18

Data tampering and complete denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acqu
CVE-2026-71026 CRITICAL
9.1 Aug 18

Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote, unauthenticated attack
CVE-2026-71015 CRITICAL
9.1 Aug 18

Unauthorized data access and manipulation in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Applicati
CVE-2026-70978 CRITICAL
9.1 Aug 18

Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (the legacy Endeca-derived

CVE-2026-61153 CRITICAL
9.1 Jul 21

Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2021-2346 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy