CVE-2021-2448

{
  "id": "CVE-2021-2448",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-2448",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-25T19:15:22.837089Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 1.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert_us@oracle.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 0.6
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Financial Services Crime and Compliance Investigation Hub",
          "versions": [
            {
              "status": "affected",
              "version": "20.1.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-21T00:15:11.987",
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2021.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert_us@oracle.com"
    },
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2021.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Financial Services Crime and Compliance Investigation Hub product of Oracle Financial Services Applications (component: Reports). The supported version that is affected is 20.1.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Financial Services Crime and Compliance Investigation Hub executes to compromise Oracle Financial Services Crime and Compliance Investigation Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Crime and Compliance Investigation Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Crime and Compliance Investigation Hub accessible data as well as unauthorized read access to a subset of Oracle Financial Services Crime and Compliance Investigation Hub accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Oracle Financial Services Crime and Compliance Investigation Hub de Oracle Financial Services Applications (componente: Reports). La versión compatible que está afectada es 20.1.2. Una vulnerabilidad difícil de explotar, permite a un atacante con altos privilegios con acceso a la infraestructura donde se ejecuta el Oracle Financial Services Crime and Compliance Investigation Hub comprometer el Oracle Financial Services Crime and Compliance Investigation Hub. Los ataques con éxito requieren una interacción humana de una persona diferente del atacante y mientras la vulnerabilidad se encuentra en Oracle Financial Services Crime and Compliance Investigation Hub, unos ataques pueden afectar significativamente a otros productos. Los ataques con éxito de esta vulnerabilidad pueden resultar en el acceso no autorizado a la actualización, inserción o eliminación de algunos de los datos accesibles de Oracle Financial Services Crime and Compliance Investigation Hub, así como el acceso no autorizado a la lectura de un subconjunto de datos accesibles de Oracle Financial Services Crime and Compliance Investigation Hub. CVSS 3.1 Puntuación Base 3.7 (Impactos en la Confidencialidad y la Integridad). Vector CVSS: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N)"
    }
  ],
  "lastModified": "2026-06-17T03:49:31.997",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:financial_services_crime_and_compliance_investigation_hub:20.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22005DDA-C5DB-4F9C-A92F-205A88B91750"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com"
}