Login Sign Up

CVE-2022-21250

8.1 HIGH

📋 TL;DR

This vulnerability in Oracle Trade Management allows authenticated attackers with low privileges to perform unauthorized data manipulation and access via HTTP. It affects Oracle E-Business Suite versions 12.2.3 through 12.2.11, potentially compromising critical business data.

💻 Affected Systems

Products:
  • Oracle E-Business Suite - Trade Management
Versions: 12.2.3 through 12.2.11
Operating Systems: All platforms running Oracle E-Business Suite
Default Config Vulnerable: ⚠️ Yes
Notes: Requires Oracle Trade Management component with GL Accounts functionality enabled.

📦 What is this software?

Trade Management by Oracle

View all CVEs affecting Trade Management →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of Oracle Trade Management data including unauthorized creation, modification, deletion of critical financial data and unauthorized access to all sensitive information.

🟠

Likely Case

Unauthorized modification of GL accounts and financial data by authenticated users with malicious intent.

🟢

If Mitigated

Limited impact if proper access controls, network segmentation, and monitoring are implemented.

🌐 Internet-Facing: HIGH - HTTP-based attack vector accessible from internet-facing systems.
🏢 Internal Only: HIGH - Even internal attackers with low privileges can exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Requires authenticated access but low privileges are sufficient. HTTP-based attack makes exploitation straightforward.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply Oracle Critical Patch Update for January 2022 or later

Vendor Advisory: https://www.oracle.com/security-alerts/cpujan2022.html

Restart Required: Yes

Instructions:

1. Download appropriate patches from Oracle Support. 2. Apply patches following Oracle E-Business Suite patching procedures. 3. Restart affected services. 4. Test functionality after patching.

🔧 Temporary Workarounds

Network Access Restriction

all

Restrict network access to Oracle Trade Management to only trusted IP addresses and networks.

Use firewall rules to limit access to Oracle E-Business Suite ports

Privilege Reduction

all

Review and minimize user privileges to only necessary functions.

Review Oracle E-Business Suite user roles and permissions

🧯 If You Can't Patch

  • Implement strict network segmentation and firewall rules to limit access to Oracle Trade Management
  • Enhance monitoring and alerting for unauthorized data access or modification attempts

🔍 How to Verify

Check if Vulnerable:

Check Oracle E-Business Suite version and patch level via Oracle applications manager or query database for version information.

Check Version:

SELECT RELEASE_NAME FROM FND_PRODUCT_GROUPS;

Verify Fix Applied:

Verify patch application through Oracle OPatch utility and confirm version is beyond affected range.

📡 Detection & Monitoring

Log Indicators:

  • Unusual GL account modifications
  • Unauthorized access patterns to Trade Management modules
  • Multiple failed authentication attempts followed by successful access

Network Indicators:

  • HTTP requests to Trade Management endpoints from unusual sources
  • Burst of data modification requests

SIEM Query:

source="oracle-ebs" AND (event_type="data_modification" OR event_type="unauthorized_access") AND component="Trade Management"

📊 Metadata

CVE ID: CVE-2022-21250
CVSS v3 Score: 8.1 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published: January 19, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON