Medium severity · published Jan 19, 2022
CVE-2022-21381
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI)
6.4
CVSS
0.6%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI). Supported versions that are affected are 8.4 and 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Session Border Controller. While the vulnerability is in Oracle Enterprise Session Border Controller, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Session Border Controller accessible data as well as unauthorized read access to a subset of Oracle Enterprise Session Border Controller accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Enterprise Session Border Controller · Oracle
8.4; 9.0 · source: NVD
Affected product
ES
Enterprise Session Border Controller
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-21381
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-21381
Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
More from Enterprise Session Border Controller
9.8
CVE-2021-3711
SM2 Decryption Buffer Overflow
7.7
CVE-2022-21382
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI)
7.7
CVE-2021-23017
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting…
7.5
CVE-2020-14630
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications Applications (component: File Upload)
7.4
CVE-2021-3712
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length