PT-2022-4069 · Oracle · Jd Edwards Enterpriseone Tools

Published 2022-07-19 · Updated 2022-07-23 · CVE-2022-21542

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions 9.2.6.3 and prior

Description The issue is related to insufficient input validation in the Web Runtime component. It allows a low-privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools, potentially impacting additional products. Successful attacks can result in unauthorized access to data, including update, insert, or delete access to some data and read access to a subset of data. It can also cause a partial denial of service.

Recommendations For versions 9.2.6.3 and prior, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the Web Runtime component until a patch is available. Avoid using HTTP requests to sensitive data in the affected component until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-04903

CVE-2022-21542

Affected Products

Jd Edwards Enterpriseone Tools

References · 4

• https://bdu.fstec.ru/vul/2022-04903 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21542 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21542 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Vendor Advisory