Paper/Archive/CVE-2022-21587

CVE-2022-21587

Oracle Corporation Web Applications Desktop Integrator — Oracle E-Business Suite Unspecified Vulnerability

KEV · due 23 Feb ransomware use EPSS 98%public exploit SSVC act CVSS 9.8

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 99.9.999 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

ProductAffectedFixed inSource

Web Applications Desktop Integrator12.2.3-12.2.11–CNA

Scores by source

oracle (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

reforacle.com/security-alerts/cpuoct2022.html refpacketstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21587 kevcisa.gov/known-exploited-vulnerabilities-catalog