Commerce Experience Manager
CVE-2021-2348
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is 11.3.1.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is 11.3.1.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Affected products include: Oracle Commerce Experience Manager, Oracle Commerce Guided Search.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Commerce Experience Manager
View allFull takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible when a low-privil
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Co
Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Co
Unauthenticated authentication bypass in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (Endeca Appl
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Conte
Unauthenticated data tampering and denial of service in Oracle Commerce Guided Search / Oracle Commerce Experience Manag
Data tampering and complete denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Content Acqu
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote, unauthenticated attack
Unauthorized data access and manipulation in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Applicati
Unauthenticated data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (the legacy Endeca-derived
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today