PT-2022-2123 · Oracle · Oracle Communications Pricing Design Center

Published 2022-01-19 · Updated 2022-01-25 · CVE-2022-21388

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Communications Pricing Design Center versions 12.0.0.3.0 through 12.0.0.4.0

Description The issue exists due to insufficient input validation in the On Premise Install component of Oracle Communications Pricing Design Center. This allows a low-privileged attacker with logon access to the infrastructure to compromise the system, resulting in unauthorized read access to a subset of accessible data.

Recommendations For versions 12.0.0.3.0 and 12.0.0.4.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-01991

CVE-2022-21388

Affected Products

Oracle Communications Pricing Design Center

References · 7

• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01991 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21388 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21388 · Vendor Advisory
• https://t.me/cvenotify/25807 · Telegram Post
• https://t.me/cibsecurity/35850 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022012315 · Note