PT-2022-3123 · Oracle · Oracle Agile Plm

Natalia Trojanowska · Published 2022-04-19 · Updated 2022-04-28 · CVE-2022-21467

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6

Description The issue exists due to insufficient input validation in the Attachments component of Oracle Agile PLM. This allows a remote attacker to gain unauthorized access to the device via HTTP requests. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.

Recommendations For version 9.3.6, consider restricting access to the Attachments component until a patch is available. As a temporary workaround, limit network access via HTTP to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03799

CVE-2022-21467

Affected Products

Oracle Agile Plm

References · 5

• https://bdu.fstec.ru/vul/2022-03799 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21467 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21467 · Security Note
• https://t.me/cibsecurity/41120 · Telegram Post