Security readout for executives and security teams
Plain-English summary
CVE-2021-2355 is a critical Oracle E-Business Suite issue in Oracle Marketing. An unauthenticated attacker with HTTP network access could read or alter critical Marketing data. The business concern is unauthorized access to sensitive customer or campaign data and unauthorized changes inside a major enterprise application.
Executive priority
Treat this as urgent for any affected Oracle E-Business Suite deployment, especially if reachable from the internet or partner networks. The main risk is data exposure and unauthorized data modification in Oracle Marketing, not service outage.
Technical view
Oracle Marketing, component Marketing Administration, in E-Business Suite versions 12.1.1-12.1.3 and 12.2.3-12.2.10 is affected. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating unauthenticated network exploitation over HTTP with high confidentiality and integrity impact but no availability impact.
Likely exposure
Exposure is most likely where affected Oracle E-Business Suite Marketing endpoints are reachable over HTTP from untrusted networks or broad internal networks. Internet-facing EBS deployments should be prioritized first, followed by partner-accessible and large internal deployments.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The vulnerability is still high-risk because Oracle describes it as easily exploitable by an unauthenticated network attacker over HTTP with critical data access and modification impact.
Researcher notes
No CWE, root-cause detail, exploit method, or active exploitation evidence is provided in the source bundle. Analysis should stay bounded to version exposure, HTTP reachability, patch status, and evidence of unauthorized data access or modification.
Mitigation direction
- Identify Oracle E-Business Suite systems running Oracle Marketing.
- Confirm whether versions match 12.1.1-12.1.3 or 12.2.3-12.2.10.
- Review Oracle July 2021 Critical Patch Update guidance for CVE-2021-2355.
- Apply vendor-supported Oracle patches or upgrade guidance where applicable.
- Restrict HTTP access to EBS Marketing from untrusted networks.
- Increase monitoring for unauthorized Marketing data access or changes.
Validation and detection
- Inventory all EBS instances and enabled Oracle Marketing components.
- Verify installed EBS and Oracle Marketing versions against affected ranges.
- Confirm applicable Oracle CPU fixes are installed and documented.
- Review access paths for public, partner, and internal HTTP reachability.
- Check logs for unusual unauthenticated requests or unexpected Marketing data changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-2355 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpujul2021.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.