CVE-2022-21359
published 2022-01-19CVE-2022-21359: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Optimization Framework). Supported versions that are affected…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.83%
53.6th percentile
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Optimization Framework). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle_corporation | peoplesoft_enterprise_pt_peopletools | — | — |
| oracle_corporation | peoplesoft_enterprise_pt_peopletools | — | — |
| oracle_corporation | peoplesoft_enterprise_pt_peopletools | — | — |
| typo3 | cms | >= 10.0.0 < 10.4.33 | 10.4.33 |
| typo3 | cms | >= 11.0.0 < 11.5.20 | 11.5.20 |
| typo3 | cms | >= 11.4.0 < 11.5.16 | 11.5.16 |
| typo3 | cms-core | >= 10.0.0 < 10.4.33 | 10.4.33 |
| typo3 | cms-core | >= 11.0.0 < 11.5.20 | 11.5.20 |
| typo3 | cms-core | >= 11.4.0 < 11.5.16 | 11.5.16 |
| typo3 | cms-core | >= 9.0.0 < 9.5.38 | 9.5.38 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
ghsa7.5HIGH
vendor_oracle6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
ghsa·2022-12-13·CVSS 7.5
CVE-2022-23500 [MEDIUM] CWE-405 TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
### Problem
Requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.
This vulnerability is very similar, but not identical, to the one described in [TYPO3-CORE-SA-2021-005](https://typo3.org/security/advisory/typo3-core-sa-2021-005) (CVE-2021-21359).
### Solution
Update to TYPO3 versions 9.5.38 ELTS, 10.4.33 or 11.5.20 that fix the problem described above.
### References
* [TYPO3-CORE-SA-2022-012](https://typo3.org/security/advisory/typ
GHSA
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
ghsa·2022-09-16·CVSS 7.5
CVE-2022-36104 [MEDIUM] CWE-770 TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C` (5.5)
### Problem
Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.
This vulnerability is the same as described in [TYPO3-CORE-SA-2021-005](https://typo3.org/security/advisory/typo3-core-sa-2021-005) ([CVE-2021-21359](https://nvd.nist.gov/vuln/detail/CVE-2021-21359)). A regression, introduced during TYPO3 v11 development, led to this situation.
### S
GHSA
GHSA-h32w-5r22-g475: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Optimization Framework)
ghsa_unreviewed·2022-01-20
CVE-2022-21359 [MEDIUM] GHSA-h32w-5r22-g475: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Optimization Framework)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Optimization Framework). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS
Oracle
Oracle Oracle PeopleSoft Risk Matrix: Optimization Framework — CVE-2022-21359
vendor_oracle·2022-01-15·CVSS 6.1
CVE-2022-21359 [MEDIUM] Oracle Oracle PeopleSoft Risk Matrix: Optimization Framework — CVE-2022-21359
Oracle Oracle PeopleSoft Risk Matrix: Optimization Framework vulnerability
CVE: CVE-2022-21359
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-01-19
Published