CVE-2021-35580

CVE-2021-35580 is an easily exploitable vulnerability in the View Reports component of Oracle Applications Manager, affecting versions 12.1.3 and 12.2.3-12.2.10 of Oracle E-Business Suite. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system, requiring human interaction from a third party. Successful attacks can lead to unauthorized read, update, insert, or delete access to a subset of Oracle Applications Manager's data, potentially impacting additional products. The vulnerability has a CVSS 3.1 Base Score of 6.1 (Medium), indicating moderate severity with low confidentiality and integrity impacts. Its attack vector is network-based with low attack complexity, but it requires user interaction. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 33/100. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. The CVE has also received minimal community discussion and media coverage, indicating a lack of widespread attention or public awareness.