7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.4 High
AI Score
Confidence
High
0.954 High
EPSS
Percentile
99.4%
The Oracle Access Manager portion of Oracle Fusion Middleware (component: OpenSSO Agent) is vulnerable to remote code execution. Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle Access Manager.
id: CVE-2021-35587
info:
name: Oracle Access Manager - Remote Code Execution
author: cckuailong
severity: critical
description: |
The Oracle Access Manager portion of Oracle Fusion Middleware (component: OpenSSO Agent) is vulnerable to remote code execution. Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle Access Manager.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
remediation: |
Apply the latest security patches provided by Oracle to mitigate this vulnerability.
reference:
- https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316
- https://nvd.nist.gov/vuln/detail/CVE-2021-35587
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-35587
cwe-id: CWE-502
epss-score: 0.95643
epss-percentile: 0.99283
cpe: cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: oracle
product: access_manager
shodan-query:
- http.title:"Oracle Access Management"
- http.title:"oracle access management"
- http.html:"/oam/pages/css/login_page.css"
fofa-query:
- body="/oam/pages/css/login_page.css"
- title="oracle access management"
google-query: intitle:"oracle access management"
tags: cve2021,cve,oam,rce,java,unauth,oracle,kev
http:
- method: GET
path:
- '{{BaseURL}}/oam/server/opensso/sessionservice'
matchers-condition: and
matchers:
- type: word
part: header
words:
- "x-oracle-dms-ecid"
- "x-oracle-dms-rid"
case-insensitive: true
condition: or
- type: word
part: body
words:
- "/oam/pages/css/general.css"
- type: status
status:
- 200
# digest: 4b0a00483046022100cf04eadf24dff0360bd0b9c0a9fc7132329a67804f9269ba963a2d957e2c4604022100f05f70423637edf33b3100c32c4f6fb4c29bcba7d120603b9f2797bd1914c246:922c64590222798bb761d5b6d8e72950
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.4 High
AI Score
Confidence
High
0.954 High
EPSS
Percentile
99.4%