PT-2022-5178 · Oracle · Oracle Database Server

Ninad · Published 2022-10-18 · Updated 2022-10-21 · CVE-2022-21606

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server version 19c

Description The issue exists due to insufficient protection of the web page structure in the Oracle Services for Microsoft Transaction Server component. This allows a remote attacker to potentially gain read, modify, add, or delete access to data. Successful attacks require human interaction and can significantly impact additional products. The vulnerability can result in unauthorized access to some data, including update, insert, or delete access, as well as unauthorized read access to a subset of data. Note that this issue applies to Windows systems only.

Recommendations For version 19c, apply the necessary patches or updates to fix the vulnerability in the Oracle Services for Microsoft Transaction Server component. As a temporary workaround, consider restricting access to the Oracle Services for Microsoft Transaction Server to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06435

CVE-2022-21606

Affected Products

Oracle Database Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-21606 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21606 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06435 · Security Note