Oracle Multiple Products Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| access manager | = 11.1.2.3.0 | |
| coherence | = 12.1.3.0.0= 12.2.1.3.0= 12.2.1.4.0= 3.7.1.0 | |
| commerce platform | = 11.0.0= 11.1.0= 11.2.0≥ 11.3.0, ≤ 11.3.2 | |
| communications diameter signaling router | ≥ 8.0.0, ≤ 8.2.2 | |
| healthcare data repository | = 7.0.1 | |
| rapid planning | = 12.1= 12.2 | |
| retail assortment planning | = 15.0= 16.0 |
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free| utilities framework | = 4.2.0.2.0= 4.2.0.3.0= 4.4.0.0.0= 4.4.0.2.0≥ 4.3.0.1.0, ≤ 4.3.0.6.0 |
| webcenter portal | = 12.2.1.3.0= 12.2.1.4.0 |