CVE-2022-21587

🗓️ 18 Oct 2022 00:00:00Reported by oracleType

cve🔗 web.nvd.nist.gov📰️ 22 Media mentions👁 911 Views🌐 WEB

Vulnerability in Oracle E-Business Suite 12.2.3-12.2.11 allows takeover of Oracle Web Applications Desktop Integrato

Reporter	Title	Published	Views	Family All 33
zdt	Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload Exploit	2 Mar 202300:00	–	zdt
GithubExploit	Exploit for Missing Authentication for Critical Function in Oracle E-Business_Suite	6 Feb 202304:18	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Oracle E-Business_Suite	6 Feb 202304:18	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Oracle E-Business_Suite	3 Mar 202312:56	–	githubexploit
ICS	CISA Red Team’s Operations Against a Federal Civilian Executive Branch Organization Highlights the Necessity of Defense-in-Depth	11 Jul 202412:00	–	ics
ATTACKERKB	CVE-2022-21587	18 Oct 202200:00	–	attackerkb
BDU FSTEC	The vulnerability of the Upload component of the software environment for working with Oracle Web Applications desktop integrations allows a hacker to gain full control over the application.	6 Feb 202300:00	–	bdu_fstec
Circl	CVE-2022-21587	19 Oct 202200:14	–	circl
CISA KEV Catalog	Oracle E-Business Suite Unspecified Vulnerability	2 Feb 202300:00	–	cisa_kev
CNNVD	Oracle E-Business Suite 访问控制错误漏洞	18 Oct 202200:00	–	cnnvd

NVD

Vulners

Node

oracle e-business_suiteRange12.2.3–12.2.11

[
  {
    "vendor": "Oracle Corporation",
    "product": "Web Applications Desktop Integrator",
    "versions": [
      {
        "version": "12.2.3-12.2.11",
        "status": "affected"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/security-alerts/cpuoct2022.html
packetstormsecurity	www.packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
bne:uueupload	request body	/OA_HTML/BneUploaderService	Unauthenticated arbitrary file upload leading to remote code execution in Oracle Web Applications Desktop Integrator (Oracle EBS).	CWE-306
file	request body	/OA_HTML/BneUploaderService	Unauthenticated arbitrary file upload leading to remote code execution in Oracle Web Applications Desktop Integrator (Oracle EBS).	CWE-306

17 Jun 2026 04:26Current

9.4Critical risk

Vulners AI Score9.4

CVSS 3.19.8

EPSS0.98342

SSVC