PT-2022-2196 · Oracle · Oracle Communications Operations Monitor

Abdelrhman Yousri · Published 2022-01-19 · Updated 2022-01-21 · CVE-2022-21246

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Communications Operations Monitor versions 3.4, 4.2, 4.3, 4.4, 5.0

Description The issue exists due to insufficient input validation in the Mediation Engine component of Oracle Communications Operations Monitor. This allows a remote attacker to gain read access to data or modify data using specially crafted HTTP requests. Successful attacks may significantly impact additional products and can result in unauthorized update, insert, or delete access to some data, as well as unauthorized read access to a subset of data.

Recommendations For versions 3.4, 4.2, 4.3, 4.4, 5.0, consider restricting access to the Mediation Engine component until a patch is available. As a temporary workaround, avoid using specially crafted HTTP requests to the affected component. Restrict network access via HTTP to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-02271

CVE-2022-21246

Affected Products

Oracle Communications Operations Monitor

References · 4

• https://bdu.fstec.ru/vul/2022-02271 · Security Note
• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21246 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21246 · Vendor Advisory