CVE-2022-21292
Published: 19 January 2022
Summary
CVE-2022-21292 is a high-severity an unspecified weakness vulnerability in Oracle Weblogic Server. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2022-21292 resides in the Samples component of Oracle WebLogic Server within Oracle Fusion Middleware. It affects supported versions 12.2.1.4.0 and 14.1.1.0.0 and carries a CVSS 3.1 base score of 7.5 with a vector indicating network attackability without authentication or user interaction.
An unauthenticated attacker with network access via HTTP can exploit the flaw to obtain unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data, resulting solely in a confidentiality impact.
Oracle published an advisory in January 2022 that addresses the issue for affected versions of the product.
The associated EPSS score has remained flat at a peak of 0.0523 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26517
Vulnerability details
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks…
more
of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.