Security readout for executives and security teams
Plain-English summary
CVE-2021-2205 is a critical Oracle E-Business Suite Oracle Marketing flaw. An unauthenticated attacker with HTTP network access could compromise Oracle Marketing data, including reading, creating, deleting, or modifying accessible records. The business concern is loss of confidentiality and integrity in marketing-related EBS data, not system availability.
Executive priority
Prioritize remediation for any reachable affected Oracle Marketing deployment. The vulnerability needs no login and can affect critical business data integrity and confidentiality, making it a high-priority enterprise application risk even without confirmed active exploitation.
Technical view
The flaw affects Oracle Marketing, Marketing Administration, in supported Oracle E-Business Suite versions 12.2.7 through 12.2.10. It is rated CVSS 9.1 with network attack vector, low complexity, no privileges, and no user interaction. The stated impacts are high confidentiality and integrity compromise, with no availability impact.
Likely exposure
Exposure is most likely where Oracle E-Business Suite includes Oracle Marketing versions 12.2.7-12.2.10 and HTTP access is reachable by untrusted users. Internet-facing, partner-facing, or broadly accessible internal deployments are higher concern.
Exploitation context
The CVE says the vulnerability is easily exploitable over HTTP without authentication. The provided sources do not show active exploitation, public exploit use, or CISA KEV listing, so exploitation status should be treated as unconfirmed.
Researcher notes
The public record gives product, version range, component, CVSS vector, and high-level impact but not root cause, proof-of-concept detail, or patch identifiers in the bundle. Validate exposure through asset inventory, component enablement, HTTP reachability, and Oracle CPU applicability.
Mitigation direction
- Identify Oracle E-Business Suite instances running Oracle Marketing 12.2.7-12.2.10.
- Review Oracle April 2021 CPU guidance for applicable vendor fixes.
- Apply Oracle-supported patches or upgrades for affected Oracle Marketing deployments.
- Restrict HTTP access to trusted networks while remediation is pending.
- Increase monitoring for unauthorized Oracle Marketing data changes.
Validation and detection
- Confirm installed Oracle E-Business Suite and Oracle Marketing versions.
- Verify whether Oracle Marketing is enabled and reachable over HTTP.
- Check patch records against Oracle April 2021 CPU guidance.
- Review access logs for unauthenticated requests to Oracle Marketing paths.
- Audit critical Oracle Marketing data for unexpected creation, deletion, or modification.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-2205 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuapr2021.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.