⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2023-02-23.

CVE-2022-21587

CWE-306 — Missing Authentication11 documents8 sources
Severity
9.8CRITICAL
EPSS
94.4%
top 0.02%
CISA KEV
KEVRansomware
Added 2023-02-02
Due 2023-02-23
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Oracle E-business SuiteOracle Corporation WEB Applications Desktop Integrator
Timeline
PublishedOct 18
KEV addedFeb 2
KEV dueFeb 23
CISA Required Action: Apply updates per vendor instructions.

Description

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Avai…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDoracle/e-business_suite12.2.3 — 12.2.11

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-64x7-wh2p-524g: Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload)↗2022-10-19
▶
CVEList
CVE-2022-21587: Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload)↗2022-10-18
▶
VulnCheck
Oracle E-Business Suite Unspecified Vulnerability↗2022
▶

💥Exploits & PoCs

1
Nuclei
Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution
▶

🔍Detection Rules

4
Suricata
ET EXPLOIT Possible Oracle E-Business RCE Attempt Inbound M3 (CVE-2022-21587)↗2023-01-27
▶
Suricata
ET EXPLOIT Possible Oracle E-Business RCE Attempt Inbound M4 (CVE-2022-21587)↗2023-01-27
▶
Suricata
ET EXPLOIT Possible Oracle E-Business RCE Attempt Inbound M2 (CVE-2022-21587)↗2023-01-27
▶
Suricata
ET EXPLOIT Possible Oracle E-Business RCE Attempt Inbound M1 (CVE-2022-21587)↗2023-01-27
▶

📋Vendor Advisories

2
CISA
Oracle E-Business Suite Unspecified Vulnerability↗2023-02-02
▶
Oracle
Oracle Oracle E-Business Suite Risk Matrix: Upload — CVE-2022-21587↗2022-10-15
▶
CVE-2022-21587 (CRITICAL CVSS 9.8) | Vulnerability in the Oracle Web App | cvebase.io