CVE-2022-21587

Oracle Corporation Web Applications Desktop Integrator

Published 18 Oct 2022 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, oracle.com

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 2 Feb 2023, with a remediation deadline of 23 Feb 2023 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

References

packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html · Exploit, Third Party Advisory, VDB Entry
www.oracle.com/security-alerts/cpuoct2022.html · Patch, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21587 · US Government Resource