CVE-2022-21518: Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: User Interface)

Medium severity · published Jul 19, 2022

CVE-2022-21518

Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: User Interface)

6.5

CVSS

0.8%

EPSS

On KEV

Description

Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: User Interface). Supported versions that are affected are 2.4.8.7 and 2.5.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Health Sciences Data Management Workbench. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Health Sciences Data Management Workbench accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 56% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Health Sciences Data Management Workbench · Oracle

2.4.8.7; 2.5.2.1 · source: NVD

Affected product

Health Sciences Data Management Workbench

Oracle

All Health Sciences Data Management Workbench CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-21518

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-21518

Vendor Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

More from Health Sciences Data Management Workbench

9.8

CVE-2019-2904

Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces)

7.2

CVE-2021-23337

Command Injection

6.6

CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses…

5.4

CVE-2019-2629

Vulnerability in the Oracle Health Sciences Data Management Workbench component of Oracle Health Sciences Applications (subcomponent: User Interface)

5.3

CVE-2020-28500

Regular Expression Denial of Service (ReDoS)