CVE-2021-2436

CVE-2021-2436 is a high-severity vulnerability affecting Oracle Common Applications within Oracle E-Business Suite versions 12.1.1-12.1.3 and 12.2.3-12.2.10, specifically in the CRM User Management Framework component. This easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the application, requiring user interaction to succeed. Successful exploitation can lead to unauthorized access to critical data, complete access to all accessible data, and unauthorized modification of some data, resulting in a CVSS 3.1 Base Score of 8.2 (High). The attack vector is network-based with low attack complexity, but requires user interaction (UI:R) to be successful. While the vulnerability is in Oracle Common Applications, successful attacks may significantly impact additional products. The primary impacts are high confidentiality and low integrity, with no availability impact. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.