PT-2022-2193 · Oracle · Oracle Communications Operations Monitor

Abdelrhman Yousri · Published 2022-01-19 · Updated 2022-01-25 · CVE-2022-21403

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Oracle Communications Operations Monitor versions 3.4 through 5.0

Description The issue is due to insufficient input validation in the Mediation Engine component. It allows a high-privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor, potentially impacting additional products. Successful attacks can result in unauthorized access to data, including update, insert, or delete access, as well as unauthorized read access and the ability to cause a partial denial of service.

Recommendations For versions 3.4 through 5.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-02268

CVE-2022-21403

Affected Products

Oracle Communications Operations Monitor

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-21403 · Security Note
• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02268 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21403 · Vendor Advisory
• https://t.me/cibsecurity/35789 · Telegram Post