CVE-2021-35587Oracle Fusion Middleware Unspecified Vulnerability
Aktif olarak istismar ediliyor — Oracle Fusion Middleware Unspecified Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 28.11.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 19.12.2022.
Gerekli işlem: Apply updates per vendor instructions. https://www.oracle.com/security-alerts/cpujan2022.html; https://nvd.nist.gov/vuln/detail/CVE-2021-35587
Açıklama
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Oracle Corporation | Access Manager | 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0 |
Kaynaklar ve yamalar
- https://www.oracle.com/security-alerts/cpujan2022.html Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35587 US Government Resource
CPE eşleşmeleri (NVD) (3)
cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:access_manager:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:*