CVE-2022-21383: Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: Log)

Medium severity · published Jan 19, 2022

CVE-2022-21383

Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: Log)

4.3

CVSS

0.8%

EPSS

On KEV

Description

Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: Log). Supported versions that are affected are 8.4 and 9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Session Border Controller. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Session Border Controller. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

None

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 57% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Enterprise Session Border Controller · Oracle

8.4; 9.0 · source: NVD

Affected product

Enterprise Session Border Controller

Oracle

All Enterprise Session Border Controller CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-21383

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-21383

Vendor Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

More from Enterprise Session Border Controller

9.8

CVE-2021-3711

SM2 Decryption Buffer Overflow

7.7

CVE-2022-21382

Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI)

7.7

CVE-2021-23017

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting…

7.5

CVE-2020-14630

Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications Applications (component: File Upload)

7.4

CVE-2021-3712

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length