High severity · published Jan 19, 2022
CVE-2022-21382
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI)
7.7
CVSS
0.9%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI). Supported versions that are affected are 8.4 and 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Session Border Controller. While the vulnerability is in Oracle Enterprise Session Border Controller, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Session Border Controller accessible data. CVSS 3.1 Base Score 7.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Enterprise Session Border Controller · Oracle
8.4; 9.0 · source: NVD
Affected product
ES
Enterprise Session Border Controller
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-21382
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-21382
Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
More from Enterprise Session Border Controller
9.8
CVE-2021-3711
SM2 Decryption Buffer Overflow
7.7
CVE-2021-23017
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting…
7.5
CVE-2020-14630
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications Applications (component: File Upload)
7.4
CVE-2021-3712
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length
6.4
CVE-2022-21381
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI)