PT-2022-2785 · Oracle · Jd Edwards Enterpriseone Tools

Published 2022-04-19 · Updated 2022-04-28 · CVE-2022-21464

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions prior to 9.2.6.3

Description The issue allows an unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of JD Edwards EnterpriseOne Tools and unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. This is due to insufficient input validation in the Business Logic Infra SEC component.

Recommendations For versions prior to 9.2.6.3, update to version 9.2.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Business Logic Infra SEC component to minimize the risk of exploitation. Avoid using HTTP requests that may trigger the vulnerability until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03312

CVE-2022-21464

Affected Products

Jd Edwards Enterpriseone Tools

References · 4

• https://bdu.fstec.ru/vul/2022-03312 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21464 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21464 · Vendor Advisory