CVE-2022-22971
In Oracle Enterprise Manager existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrität und Verfügbarkeit gefährden. Für die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle veröffentlicht keine weiteren Details zu diesen Schwachstellen (außer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadenshöhe ausschließlich auf Basis der CVSS Impact Matrix. Der Maximalwert für diese Produkte ist "HIGH" für "Confidentiality", "Integrity" und "Availability" über alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert "HOCH" für die Schadenshöhe.
EPSS 0.25% · 48.2th percentile
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Oracle Communications 7.1.0 | |
| Oracle | Oracle Financial Services Applications 8.0.8.3.1 | |
| Oracle | Oracle Retail Applications 15.0.3.1 | |
| Oracle | Oracle Communications 22.2.3 | |
| Oracle | Oracle Financial Services Applications 2.9 | |
| Oracle | Oracle Retail Applications 19.0.0.6 | |
| Oracle | Oracle Financial Services Applications 19.1 | |
| Oracle | Oracle Communications Applications <=6.0.1 | |
| Oracle | Oracle Communications 22.1.0.0.0 | |
| IBM | IBM Spectrum Protect Plus 10.1 | |
| Oracle | Oracle Financial Services Applications 8.1.1.1.7 | |
| Oracle | Oracle Financial Services Applications 22.2 | |
| Oracle | Oracle Communications Applications 7.4.0 | |
| Oracle | Oracle Financial Services Applications 19.2 | |
| Oracle | Oracle Financial Services Applications 8.1.0.1.4 | |
| Oracle | Oracle Communications 8.2.3.0 | |
| Oracle | Oracle Communications <=22.4.0 | |
| Oracle | Oracle Financial Services Applications 2.7 | |
| Oracle | Oracle Communications 22.3.4 | |
| Oracle | Oracle Financial Services Applications 8.1.2.2 |
…and 118 more
Exploit Intelligence
- tchize/CVE-2022-22971 (github-poc)
- tchize/CVE-2022-22971 (github-poc)
- tchize/CVE-2022-22971 (github-poc)
- tchize/CVE-2022-22971 (github-poc)
- tchize/CVE-2022-22971 (github-poc)
- tchize/CVE-2022-22971 (github-poc)
Timeline
- May 10, 2022 CVE Published
- May 13, 2022 EPSS Score
- Jul 1, 2022 EPSS Score
- Oct 9, 2022 EPSS Score
- Nov 27, 2022 EPSS Score
- Jan 15, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 23, 2023 EPSS Score
- Jun 12, 2023 EPSS Score
- Sep 18, 2023 EPSS Score
- Nov 6, 2023 EPSS Score
- Dec 25, 2023 EPSS Score
References
- https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0361.json advisory
- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0361 advisory
- https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now advisory
- https://security.netapp.com/advisory/ntap-20220616-0006/ advisory
- https://www.jfrog.com/confluence/display/JFROG/Fixed+Security+Vulnerabilities advisory
- https://www.ibm.com/support/pages/node/7144861 advisory
- https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0126.json advisory
- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0126 advisory
- https://www.oracle.com/security-alerts/cpujan2023.html#AppendixMSQL advisory
- https://ubuntu.com/security/notices/USN-5823-2 advisory
- https://ubuntu.com/security/notices/USN-5823-1 advisory
- https://ubuntu.com/security/notices/USN-5823-3 advisory
- https://security.netapp.com/advisory/ntap-20230208-0002/ advisory
- https://alas.aws.amazon.com/ALAS-2023-1686.html advisory
- https://alas.aws.amazon.com/AL2/ALAS-2023-1973.html advisory
- https://access.redhat.com/errata/RHSA-2023:2621 advisory
- https://access.redhat.com/errata/RHSA-2023:3087 advisory
- https://oss.oracle.com/pipermail/el-errata/2023-May/013976.html advisory
- https://linux.oracle.com/errata/ELSA-2023-3087.html advisory
- https://www.ibm.com/support/pages/node/6981105 advisory
…and 76 more