CVE-2021-2198

What it actually does

CVE-2021-2198 is a network-exploitable cross-site scripting vulnerability in the Setup/Admin component of Oracle Knowledge Management within Oracle E-Business Suite. An unauthenticated attacker can deliver malicious HTTP content that executes JavaScript in the browser of a victim user who interacts with the crafted request or page. Because the script runs in the context of the affected Oracle application, it can act with the victim’s session privileges, potentially exposing critical Oracle Knowledge Management data and allowing unauthorized modification, insertion, or deletion of some accessible data. The CVSS scope change indicates that compromise may affect data or functions beyond the vulnerable component.

Why it matters to the business

Successful exploitation can let an attacker steal sensitive knowledge-management data, manipulate business content, and abuse a legitimate user’s active session without needing their password. In Oracle E-Business Suite environments, this can create broader operational risk because the affected component may share authentication, session context, or business workflows with other EBS products. The issue is not listed in CISA KEV and ransomware use is not identified, but the EPSS score is high, the vulnerability is remotely reachable over HTTP, and the affected versions are old, making prompt remediation important for internet-facing or broadly accessible EBS deployments.

How an attack unfolds

An attacker identifies an Oracle E-Business Suite deployment exposing Oracle Knowledge Management functionality over HTTP or HTTPS. The attacker crafts a malicious URL, form submission, or embedded link containing JavaScript payload content that is accepted by the vulnerable Setup/Admin component. The attacker then persuades an authenticated user, typically an administrator or privileged business user, to click the link or otherwise interact with the crafted content. When the user’s browser processes the response from the affected Oracle application, the injected script executes under the trusted application origin. The script can read page content, issue same-origin requests using the victim’s session, access sensitive Knowledge Management data visible to that user, and perform permitted write actions such as updates, inserts, or deletes. Depending on EBS integration and the victim’s privileges, the attacker may use the foothold to affect related Oracle application data or workflows.

How to fix it

Apply the relevant Oracle Critical Patch Update or E-Business Suite patch that remediates CVE-2021-2198 for Oracle Knowledge Management. Supported affected versions are Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.10; systems on these releases should be patched or upgraded to a supported, fixed EBS release. If immediate patching is not possible, reduce exposure by restricting access to Oracle E-Business Suite and Knowledge Management administration functions to trusted networks, enforcing VPN or ZTNA access, limiting administrative privileges, enabling WAF rules for reflected/stored XSS payloads, and strengthening anti-phishing controls. Mitigations reduce risk but should not be treated as a substitute for Oracle’s security patches.

How to confirm the fix worked

Confirm remediation by reviewing Oracle E-Business Suite patch inventory and verifying that the Oracle Critical Patch Update containing the fix has been applied to all affected application tiers. Validate that no deployed instance remains on unpatched Oracle Knowledge Management versions 12.1.1-12.1.3 or 12.2.3-12.2.10. From a controlled test environment, use an authenticated and unauthenticated security test to confirm that HTML and JavaScript payloads submitted to Knowledge Management Setup/Admin parameters are safely encoded or rejected and do not execute in the browser. Also verify that compensating controls, such as WAF signatures, network restrictions, and privileged-user access controls, are active for any systems awaiting patching.

Typical attack path

1. Reconnaissance: identify an Oracle E-Business Suite instance with Oracle Knowledge Management enabled and reachable over HTTP/HTTPS.
2. Targeting: determine whether users with Knowledge Management Setup/Admin access can be induced to interact with crafted content.
3. Payload preparation: create a malicious URL or HTTP request containing JavaScript or encoded HTML content designed to execute in the victim’s browser.
4. Delivery: send the crafted link through phishing, chat, ticket comments, documentation pages, or another channel likely to be trusted by the target user.
5. User interaction: the victim clicks the link or opens the attacker-controlled content while authenticated to Oracle E-Business Suite.
6. Execution: the vulnerable component reflects or processes the payload so that attacker-controlled JavaScript runs in the trusted Oracle application origin.
7. Session abuse: the script reads sensitive data and sends authenticated same-origin requests using the victim’s active session.
8. Impact: the attacker exfiltrates Oracle Knowledge Management data and may modify, insert, or delete accessible records depending on victim privileges.

How to detect it

To determine whether exploitation may have occurred, examine web server, reverse proxy, WAF, load balancer, and Oracle E-Business Suite application logs for requests to Oracle Knowledge Management or EBS administration pages containing encoded or literal JavaScript/HTML payloads. Focus on requests followed by privileged user activity, unusual redirects, unexpected outbound connections from user browsers, or Knowledge Management create/update/delete actions that the user does not recognize. Review phishing reports, email gateways, and collaboration tools for links to EBS pages with suspicious query strings. In browser telemetry or EDR, look for users accessing EBS URLs immediately before outbound requests to unfamiliar domains, especially where the URL contains script tags, event-handler attributes, or JavaScript URI schemes. In application audit logs, look for anomalous changes to Knowledge Management content, setup records, or administrative configuration shortly after suspicious HTTP requests. Because public details do not identify a single endpoint or payload, detection should combine XSS payload hunting with correlation to privileged EBS session activity.

• <script
• %3Cscript
• </script>
• %3C%2Fscript%3E
• javascript:
• javascript%3A
• onerror=
• %20onerror%3D
• onload=
• %20onload%3D
• document.cookie
• document%2Ecookie
• document.location
• window.location
• XMLHttpRequest
• fetch(
• eval(
• String.fromCharCode
• %3Cimg
• %3Csvg
• alert(
• prompt(
• confirm(
• /OA_HTML/

What your security team should do

• Prioritize patching for any internet-facing or broadly reachable Oracle E-Business Suite deployment that includes Oracle Knowledge Management, especially because the EPSS score is high.
• Inventory all Oracle E-Business Suite instances and confirm whether Oracle Knowledge Management is enabled and whether versions fall within 12.1.1-12.1.3 or 12.2.3-12.2.10.
• Apply the appropriate Oracle Critical Patch Update or upgrade to a supported fixed EBS release; do not rely solely on WAF filtering for long-term protection.
• Restrict access to Knowledge Management Setup/Admin functions to trusted administrative networks and least-privileged users.
• Review recent web, WAF, reverse proxy, and Oracle application logs for XSS-like payloads targeting EBS and Knowledge Management paths or parameters.
• Educate privileged EBS users to avoid clicking unsolicited links while authenticated to Oracle applications.
• Ensure session protections are configured, including short idle timeouts, secure cookies, HTTPS-only access, and reauthentication for sensitive administrative actions where supported.
• If suspicious activity is found, reset affected user sessions, rotate credentials where appropriate, and review Knowledge Management data for unauthorized reads or modifications.