CVE-2022-21467: Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Attachments)

Medium severity · published Apr 19, 2022

CVE-2022-21467

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Attachments)

6.5

CVSS

0.9%

EPSS

On KEV

Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Attachments). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.9% · higher than 60% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Agile Product Lifecycle Management · Oracle

9.3.6 · source: NVD

Affected product

Agile Product Lifecycle Management

Oracle

All Agile Product Lifecycle Management CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-21467

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-21467

Vendor Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

More from Agile Product Lifecycle Management

9.8

CVE-2020-1938

Apache Tomcat Improper Privilege Management Vulnerability

9.8

CVE-2019-2725

Oracle WebLogic Server, Injection

9.8

CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…

8.8

CVE-2024-20953

Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

8.1

CVE-2017-12617

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g