Cyber Resilience

CVE-2021-31812

Medium

Published: 12 June 2021

Published
12 June 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score 0.0023 46.1th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-31812 is a medium-severity Excessive Iteration (CWE-834) vulnerability in Oracle Banking Corporate Lending Process Management. Its CVSS base score is 5.5 (Medium).

Operationally, ranked at the 46.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.

CWE(s)
CWE-834CWE-835

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

apache
pdfbox
2.0.0 — 2.0.23
fedoraproject
fedora
33, 34
oracle
banking corporate lending process management
14.2.0, 14.3.0, 14.5.0
oracle
banking credit facilities process management
14.2.0, 14.3.0, 14.5.0
oracle
banking supply chain finance
14.2.0, 14.3.0, 14.5.0
oracle
retail customer management and segmentation foundation
18.1
oracle
communications messaging server
8.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CP-7 Alternate Processing Site
addresses: CWE-835

Enables transfer to alternate site if an infinite loop at the primary renders processing unavailable.

SC-5 Denial-of-service Protection
addresses: CWE-835

Detects and mitigates infinite loops that produce sustained resource consumption.

References