Main Vulnerability Database Vulnerabilities #VU60091

Improper input validation in Oracle Communications Cloud Native Core Policy - CVE-2021-22119

Published: January 27, 2022 / Updated: November 10, 2022

Vulnerability identifier: #VU60091

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22119

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Policy (Spring Security) component in Oracle Communications Cloud Native Core Policy. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.

Affected software

Oracle Communications Cloud Native Core Policy
MySQL Enterprise Monitor
Oracle Communications Cloud Native Core Network Repository Function
IBM Process Mining

How to mitigate CVE-2021-22119

Install updates from vendor's website.

MySQL Enterprise Monitor - update to 8.0.27
IBM Process Mining - update to 1.14.1

Links to Public Exploits and PoC-codes

Exploit #8594 - oauth-client-exploit (Applications that reproduce CVE-2021-22119) (November 10, 2022)

External References

https://www.oracle.com/security-alerts/cpujan2022.html