Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-65317
HistoryMay 06, 2022 - 12:00 a.m.

USU Oracle Optimization Command Injection Vulnerability

2022-05-0600:00:00
China National Vulnerability Database
www.cnvd.org.cn
16
oracle
optimization
command injection
vulnerability
version 5.17.5
datacollection
attack
base64 decoding
root access

EPSS

0.004

Percentile

75.1%

USU Oracle Optimization is used to improve the performance of Oracle queries. command injection vulnerability exists in versions of USU Oracle Optimization prior to 5.17.5. The vulnerability stems from the fact that some common OS commands are blocked, but OS commands for base64 decoding are not blocked, and an authenticated DataCollection attacker can exploit this vulnerability to launch any shell command from the server as root on the agent.

EPSS

0.004

Percentile

75.1%

Related for CNVD-2022-65317