WaratekVRT Sign in

CVE-2021-2302 Oracle Platform Security for Java

Affected softwareOracle Platform Security for Java
Affected versions11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
Severity9.8 Critical CVSS 3.1 2 scores
Fixed inOracle Critical Patch Update April 2021
Published22 Apr 2021
Updated17 Jun 2026

Description

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: OPSS). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed Published artifacts you can open, in GitHub PoC; first seen 2021-09-16.
  • EPSS 5.7% chance in 30 days
IndexArtifactStarsFirst seen
GitHub PoC quynhle7821/CVE-2021-2302 9 2021-09-16

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by An indexed exploit clearing the evidence bar to reverse-engineer, where there is no source to read
Finding Mitigation candidate: 1 public proof-of-concept exploit(s) are indexed for this CVE (github-poc), but the affected code is not open source. That makes an ARMR patch rule a candidate rather than a plan. The exploit gives a reproducible entry point to trace inward from and a test to validate a hook against, which is what makes reverse engineering tractable at all. No rule exists and none is scheduled: the hook point must be recovered by decompiling the affected code, and a closer look may find none that ARMR can act on.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H secalert_us@oracle.com Secondary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2021 ↗ CPU 2021-Q2 Oracle Fusion Middleware / OPSS (11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware OPSS 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0

Products and versions

1 product, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle platform security for java generic 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0

References

URLTags
https://www.oracle.com/security-alerts/cpuapr2021.html Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-460/ Third Party Advisory, VDB Entry

Timeline
Published2021-04-22By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.