Unauthorized Access Vulnerability in Oracle Enterprise Manager
CVE-2022-21392

8.8HIGH

Key Information:

Vendor
Oracle
Status
Enterprise Manager Base Platform
Vendor
CVE Published:
19 January 2022

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The vulnerability in Oracle's Enterprise Manager Base Platform allows attackers with low privileges and network access to exploit the system through HTTP. This exploitation can lead to unauthorized access to critical data and potential control over all accessible data, enabling attackers to update, insert, or delete information within the Enterprise Manager system. Organizations using affected versions 13.4.0.0 and 13.5.0.0 must take immediate action to secure their environments.

Affected Version(s)

Enterprise Manager Base Platform 13.4.0.0

Enterprise Manager Base Platform 13.5.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-21392
Created by mbadanoiu

References

https://www.oracle.com/security-alerts/cpujan2022.html
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.