CVE-2022-21392
published 2022-01-19CVE-2022-21392: Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected…
PriorityP346high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.56%
42.7th percentile
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Base Platform accessible data as well as unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 8.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| msrc | microsoft_visual_studio_2022_version_17.4 | — | — |
| msrc | microsoft_visual_studio_2022_version_17.6 | — | — |
| msrc | microsoft_visual_studio_2022_version_17.8 | — | — |
| msrc | microsoft_visual_studio_2022_version_17.9 | — | — |
| msrc | net_7.0 | — | — |
| msrc | net_8.0 | — | — |
| msrc | powershell_7.3 | — | — |
| msrc | powershell_7.4 | — | — |
| oracle | enterprise_manager_base_platform | — | — |
| oracle | enterprise_manager_base_platform | — | — |
| oracle_corporation | enterprise_manager_base_platform | — | — |
| oracle_corporation | enterprise_manager_base_platform | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_oracle8.8HIGH
vendor_msrc7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
.NET and Visual Studio Denial of Service Vulnerability
vendor_msrc·2024-03-12·CVSS 7.5
CVE-2024-21392 [HIGH] CWE-400 .NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
.NET: .NET
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Denial of Service
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;DOS:N/A
Remediation: Release Notes
Reference: https://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.9
Reference: https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
Reference: https://github.com/PowerShell/Announcements/issues/59
Reference: https://dotnet.microsoft.com/en-us/download/dotnet/7.0
Reference: https://support.microsoft.com/help/5036451
Reference: https://dotnet.microsoft.com/en-us/download/dotnet/8.0
Reference: https://support.microsoft.com/help/5036452
Reference: https://my.visualstudio
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Policy Framework — CVE-2022-21392
vendor_oracle·2022-01-15·CVSS 8.8
CVE-2022-21392 [HIGH] Oracle Oracle Enterprise Manager Risk Matrix: Policy Framework — CVE-2022-21392
Oracle Oracle Enterprise Manager Risk Matrix: Policy Framework vulnerability
CVE: CVE-2022-21392
CVSS: 8.8
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujan2022 (JAN 2022)
GHSA
GHSA-4p56-cj9x-3w65: Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework)
ghsa_unreviewed·2022-01-20
CVE-2022-21392 [HIGH] GHSA-4p56-cj9x-3w65: Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework)
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Base Platform accessible data as well as unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-01-19
Published