PT-2022-4071 · Oracle · Oracle Flexcube Universal Banking

Sanehdeep Singh · Published 2022-07-19 · Updated 2022-07-25 · CVE-2022-21544

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle FLEXCUBE Universal Banking versions 12.1 through 12.4 Oracle FLEXCUBE Universal Banking versions 14.0 through 14.3 Oracle FLEXCUBE Universal Banking version 14.5

Description The issue is related to errors in the code of the Infrastructure component of Oracle FLEXCUBE Universal Banking, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and can result in the takeover of Oracle FLEXCUBE Universal Banking.

Recommendations For versions 12.1 through 12.4, update to a version outside of this range to mitigate the risk. For versions 14.0 through 14.3, update to a version outside of this range to mitigate the risk. For version 14.5, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the Infrastructure component until a patch is available. Avoid using HTTP requests to the affected component until the issue is resolved.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2022-04905

CVE-2022-21544

Affected Products

Oracle Flexcube Universal Banking

References · 4

• https://osv.dev/vulnerability/CVE-2022-21544 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21544 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04905 · Security Note