Lucene search

PRIOn knowledge basePRION:CVE-2022-21587

HistoryOct 18, 2022 - 9:15 p.m.

Code injection

2022-10-1821:15:00

PRIOn knowledge base

www.prio-n.com

code injection

oracle

e-business suite

desktop integrator

vulnerability

http

cvss

network access

takeover

9.4 High

AI Score

Confidence

High

0.972 High

EPSS

Percentile

99.8%

JSON

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CPENameOperatorVersion
e-business_suitege12.2.3
e-business_suitele12.2.11

CPE	Name	Operator	Version
	e-business_suite	ge	12.2.3
	e-business_suite	le	12.2.11

References

packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html

www.oracle.com/security-alerts/cpuoct2022.html