CVE-2022-21559

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Platform executes to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2022.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:commerce_platform:11.3.0:::::::*
	cpe:2.3:a:oracle:commerce_platform:11.3.1:::::::*
	cpe:2.3:a:oracle:commerce_platform:11.3.2:::::::*

History

26 Jul 2022, 17:40

Type	Values Removed	Values Added
CPE		cpe:2.3:a:oracle:commerce_platform:11.3.1:::::::* cpe:2.3:a:oracle:commerce_platform:11.3.2:::::::* cpe:2.3:a:oracle:commerce_platform:11.3.0:::::::*
First Time		Oracle Oracle commerce Platform
References	~~(MISC) https://www.oracle.com/security-alerts/cpujul2022.html -~~	(MISC) https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Vendor Advisory
CWE		NVD-CWE-noinfo

19 Jul 2022, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-07-19 22:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-21559

Mitre link : CVE-2022-21559

CVE.ORG link : CVE-2022-21559

JSON object : View

Products Affected

oracle

commerce_platform

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-21559", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-07-19T22:15:12.680", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2022.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Commerce Platform executes to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."}, {"lang": "es", "value": "Una vulnerabilidad en el producto Oracle Commerce Platform de Oracle Commerce (componente: Dynamo Application Framework). Las versiones afectadas son 11.3.0, 11.3.1 y 11.3.2. Una vulnerabilidad explotable f\u00e1cilmente permite a un atacante poco privilegiado y con acceso a la infraestructura en la que es ejecutado Oracle Commerce Platform, poner en peligro dicha plataforma. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en el acceso no autorizado a datos cr\u00edticos o en el acceso completo a todos los datos accesibles de Oracle Commerce Platform. CVSS 3.1, Puntuaci\u00f3n Base 5.5 (impactos en la Confidencialidad). Vector CVSS: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."}], "lastModified": "2022-07-26T17:40:26.307", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:commerce_platform:11.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57DA1DD8-E9F1-43C6-BCA2-1E9C92B1664C"}, {"criteria": "cpe:2.3:a:oracle:commerce_platform:11.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "869CDD22-4A6C-4665-AA37-E340B07EF81C"}, {"criteria": "cpe:2.3:a:oracle:commerce_platform:11.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CDE72F7-ED9D-4A53-BF63-DF6711FFDEF4"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}