PT-2022-14981 · Oracle · Oracle Communications Billing/Revenue Management

Published 2022-10-18 · Updated 2022-10-20 · CVE-2022-21601

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Oracle Communications Billing and Revenue Management versions 12.0.0.4.0 through 12.0.0.7.0

Description The issue allows an unauthenticated attacker with network access via TCP to compromise Oracle Communications Billing and Revenue Management, resulting in unauthorized read access to a subset of accessible data and the ability to cause a partial denial of service.

Recommendations For versions 12.0.0.4.0 through 12.0.0.7.0, update to a version that is not affected by this issue to prevent unauthorized access and denial of service attacks. As a temporary workaround, consider restricting network access to the Connection Manager component until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2022-21601

Affected Products

Oracle Communications Billing/Revenue Management

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-21601 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21601 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2022.html · Vendor Advisory
• https://t.me/cibsecurity/51698 · Telegram Post