PT-2022-3108 · Oracle · Oracle Banking Payments

Published 2022-04-19 · Updated 2023-08-08 · CVE-2022-21475

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:N/AC:H/Au:S/C:P/I:C/A:P

Name of the Vulnerable Software and Affected Versions Oracle Banking Payments versions 14.5

Description The issue is related to incorrect permission assignment for a critical resource in the Infrastructure component of Oracle Banking Payments. This can be exploited by a remote attacker to create, delete, or modify access to critical data, gain read access to data, or cause a partial denial of service using specially crafted HTTP requests. The attack requires human interaction from someone other than the attacker and can result in unauthorized access to or modification of critical data, as well as partial denial of service.

Recommendations For version 14.5, update the software to a version that includes the fix for this issue, as the current version allows attackers with low privileges and network access via HTTP to compromise Oracle Banking Payments. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2022-03779

CVE-2022-21475

Affected Products

Oracle Banking Payments

References · 4

• https://oracle.com/security-alerts/cpuapr2022.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21475 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21475 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03779 · Security Note