CVE-2021-2345

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is 11.3.1.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized read access to a subset of Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

• https://www.oracle.com/security-alerts/cpujul2021.htmlPatch, Vendor Advisory
• https://www.oracle.com/security-alerts/cpujul2021.htmlPatch, Vendor Advisory

Published

Jul 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23444This affects the package jointjs before 3.4.2. A type confus…9.8
• CVE-2021-23445This affects the package datatables.net before 1.11.3. If an…6.1
• CVE-2021-23446The package handsontable before 10.0.0; the package handsont…7.5
• CVE-2021-23447This affects the package teddy before 0.5.9. A type confusio…6.1
• CVE-2021-23448All versions of package config-handler are vulnerable to Pro…9.8
• CVE-2021-23449This affects the package vm2 before 3.9.4 via a Prototype Po…10
• CVE-2021-23450All versions of package dojo are vulnerable to Prototype Pol…9.8
• CVE-2021-23451The package otp-generator before 3.0.0 are vulnerable to Ins…9.8
• CVE-2021-23452This affects all versions of package x-assign. The global pr…9.8
• CVE-2021-2346Vulnerability in the Oracle Commerce Guided Search / Oracle …5.4
• CVE-2021-23460The package min-dash before 3.8.1 are vulnerable to Prototyp…7.5
• CVE-2021-23463The package com.h2database:h2 from 1.4.198 and before 2.0.20…9.1