Advertisement Banner
  • Home
  • News
  • Cyber News
  • Contact
No Result
View All Result
  • Home
  • News
  • Cyber News
  • Contact
No Result
View All Result
Wellnessnewshubb
No Result
View All Result
Home Cyber News

CISA adds Oracle Fusion Middleware flaw to its Known Exploited Vulnerabilities CatalogSecurity Affairs

admin by admin
November 29, 2022
in Cyber News


CISA added a critical flaw impacting Oracle Fusion Middleware, tracked as CVE-2021-35587, to its Known Exploited Vulnerabilities Catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) a critical vulnerability impacting Oracle Fusion Middleware, tracked as CVE-2021-35587 (CVSS 3.1 Base Score 9.8), to its Known Exploited Vulnerabilities Catalog.

An unauthenticated attacker with network access via HTTP can exploit the vulnerability to compromise Oracle Access Manager.

“Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8” states the NIST.

The flaw was reported in March and affects versions 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. The IT giant fixed the issue in January with the release of the Critical Patch Update.

“This vulnerability was discovered by accident by me and Peterjson while we were analyzing and building PoC for another mega-0day (which is still not fixed by now 😉 ).” reads the post published security researcher Nguyen Jang (Janggggg) who reported the flaw alongside peterjson. “It’s quiet easy to access the entrypoint and exploit the vulnerability, so it’s recommend to apply the patch now! It may give the attacker access to OAM server, to create any user with any privileges, or just get code execution in the victim’s server.”

Below is the video PoC published by Nguyen Jang.

CISA orders federal agencies to fix these vulnerabilities by December 19, 2022.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)



Share On






Source link

Previous Post

India’s G20 presidency will reflect interests of global south, says Jaishankar –

Next Post

Google reveals Spanish IT firm’s links to spyware targeting Chrome, Firefox and Microsoft Defender

Next Post

Google reveals Spanish IT firm's links to spyware targeting Chrome, Firefox and Microsoft Defender

Recommended

Regulators should seek greater disclosure from stablecoin issuers: HK monetary authority researchers

3 months ago

No country can defeat terrorism on its own: Amit Shah –

3 months ago

© 2022 Law Enforcement News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Cyber News
  • Contact

Newsletter Sign Up.

No Result
View All Result
  • Home
  • News
  • Cyber News
  • Contact

© 2022 Law Enforcement News Hubb All rights reserved.