CVE-2022-21587
Published: 18 October 2022
Summary
CVE-2022-21587 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Oracle E-Business Suite. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-8 (Identification and Authentication (Non-organizational Users)).
Deeper analysis
CVE-2022-21587 is an unauthenticated arbitrary file upload vulnerability in the Upload component of Oracle Web Applications Desktop Integrator within Oracle E-Business Suite versions 12.2.3 through 12.2.11. The flaw stems from missing authentication for a critical function and carries a CVSS 3.1 base score of 9.8, reflecting full compromise of confidentiality, integrity, and availability.
An unauthenticated attacker with network access over HTTP can exploit the issue to upload and execute arbitrary files, resulting in complete takeover of the affected Oracle Web Applications Desktop Integrator instance without any user interaction or privileges.
Oracle's October 2022 Critical Patch Update addresses the vulnerability for supported releases. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog, and public proof-of-concept code demonstrating unauthenticated file upload has been published.
The EPSS score reached a peak of 0.9749 and currently stands at 0.9440, indicating sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26811
Vulnerability details
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.…
more
Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- CWE(s)
- KEV Date Added
- 02 February 2023
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations on the Upload component so that unauthenticated HTTP requests cannot invoke the critical function.
Requires identification and authentication of non-organizational users before granting access to network-exposed EBS services.
Explicitly limits the set of actions (such as arbitrary file upload) that may be performed without identification or authentication.