PT-2022-3364 · Oracle · Oracle Jdeveloper

Published 2022-04-19 · Updated 2022-04-19 · CVE-2022–21445

PT · AI

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Oracle Jdeveloper (affected versions not specified)

Description: The issue is related to the ADF Faces component of Oracle Jdeveloper, which is vulnerable to a memory corruption flaw. This flaw can be exploited by a remote attacker to execute arbitrary code or gain full control of the application using the HTTP protocol.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-04130

CVE-2022–21445

Affected Products

Oracle Jdeveloper

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-21445 · Security Note
• https://bdu.fstec.ru/vul/2022-04130 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Note
• https://peterjson.medium.com/miracle-one-vulnerability-to-rule-them-all-c3aed9edeea2 · Note