PT-2022-4695 · Oracle · Oracle Webcenter Sites Support Tools

Hugo Santiago Dos Santos · Published 2022-07-19 · Updated 2022-07-26 · CVE-2022-21575

Positive Technologies (AI Summary)

CVSS v2.0

7.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Sites Support Tools versions prior to 4.4.2

Description The issue exists due to insufficient input validation in the User Interface component of Oracle WebCenter Sites Support Tools, part of the Oracle Fusion Middleware platform. This allows a remote attacker to gain unauthorized access to read, modify, or add data, or cause a denial of service via the HTTP protocol. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized update, insert, or delete access to some accessible data, and the ability to cause a partial denial of service.

Recommendations For versions prior to 4.4.2, update to version 4.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the User Interface component until a patch is available. Avoid using the HTTP protocol to access Oracle WebCenter Sites Support Tools until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-05585

CVE-2022-21575

Affected Products

Oracle Webcenter Sites Support Tools

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-21575 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21575 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05585 · Security Note
• https://t.me/cibsecurity/46617 · Telegram Post
• https://t.me/cvenotify/33788 · Telegram Post