Critical severity · published Apr 19, 2022
CVE-2022-21445
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
In wildKEV
9.8
CVSS
62.5%
EPSS
Yes
On KEV
Description
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)62.5% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 18, 2024
Federal remediation dueOct 9, 2024
Ransomware campaign useNot known
Affected products
Which versions
AD
Application Development Framework (ADF) · Oracle Corporation
12.2.1.3.0; 12.2.1.4.0 · source: vendor
AD
Application Development Framework · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
JD
Jdeveloper · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: CISA
AF
ADF Faces · Oracle
All versions, or not specified · source: KEV
Affected product
AD
Application Development Framework (ADF)
Oracle Corporation