CVE-2021-2078: 
NixOS vulnerability analysis and mitigation

CVE-2021-2078 is a vulnerability discovered in the Oracle Configurator product of Oracle Supply Chain, specifically affecting the UI Servlet component in versions 12.1 and 12.2. The vulnerability was disclosed in December 2020 and received a CVSS 3.1 Base Score of 8.2 (Oracle Advisory).

The vulnerability is easily exploitable by an unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. The CVSS vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), indicating network accessibility, low attack complexity, no privileges required, and requiring user interaction (Oracle Advisory).

Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. Additionally, attackers may gain unauthorized update, insert or delete access to some Oracle Configurator accessible data. The vulnerability has high confidentiality impact and low integrity impact, with no effect on availability (Oracle Advisory).

The vulnerability is considered easily exploitable but requires human interaction from a person other than the attacker. While the vulnerability exists in Oracle Configurator, successful attacks may significantly impact additional products (Oracle Advisory).

Oracle released patches for this vulnerability as part of their January 2021 Critical Patch Update. Users are strongly advised to apply these security patches without delay to protect against potential exploitation (Oracle Advisory).