CVE-2022-21350
Published: 19 January 2022
Summary
CVE-2022-21350 is a medium-severity an unspecified weakness vulnerability in Oracle Weblogic Server. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-21350 affects the Core component of Oracle WebLogic Server in Oracle Fusion Middleware. The vulnerability impacts versions 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 and carries a CVSS 3.1 base score of 6.5 reflecting integrity and availability consequences.
An unauthenticated attacker with network access via the T3 protocol can exploit the flaw to perform unauthorized updates, inserts, or deletions against some accessible data and to induce a partial denial of service.
The Oracle Critical Patch Update for January 2022, published at https://www.oracle.com/security-alerts/cpujan2022.html, supplies the official patches and mitigation guidance for the affected releases. The associated EPSS score has remained at 0.4620 with no material post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26575
Vulnerability details
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.…
more
Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.