CVEvulnerability

CVE-2022-21587

9.8 CRITICAL Known exploited Published 2022-10-18 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Oracle E-Business Suite Unspecified Vulnerability — Oracle E-Business Suite

Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.

Added to KEV
2023-02-02
Remediation due
2023-02-23
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://www.oracle.com/security-alerts/cpuoct2022.html; https://nvd.nist.gov/vuln/detail/CVE-2022-21587
Status
Analyzed
Published
2022-10-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306

Description

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected configurations

• oracle e-business suite (>= 12.2.3 <= 12.2.11)

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References