CVE-2021-2345

CVE-2021-2345 is a medium-severity vulnerability affecting Oracle Commerce Guided Search and Oracle Commerce Experience Manager (version 11.3.1.5), specifically within the Tools and Frameworks component. This easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized read and limited modification access to accessible data. Successful exploitation requires human interaction from a victim and can impact additional products beyond the immediate Oracle Commerce components. The vulnerability has a CVSS 3.1 Base Score of 5.4, indicating a medium severity due to its low attack complexity and the requirement for user interaction, yet it can lead to partial confidentiality and integrity compromise. While the attack vector is network-based, the scope is changed, meaning impacts can extend beyond the vulnerable component. Currently, there is no evidence of active exploitation, nor are there any publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. The vulnerability has also received minimal community discussion and media coverage, suggesting a low level of public awareness or concern.