Improper input validation in Enterprise Manager Base Platform - CVE-2022-29577

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU65469

Improper input validation in Enterprise Manager Base Platform - CVE-2022-29577

Published: July 19, 2022


Vulnerability identifier: #VU65469
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-29577
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Manager Install (AntiSamy) component in Enterprise Manager Base Platform. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


Affected software

Enterprise Manager Base Platform
Oracle Banking Party Management
Oracle Banking Deposits and Lines of Credit Servicing
Oracle Banking Enterprise Default Management
Oracle Financial Services Regulatory Reporting with AgileREPORTER
IBM Maximo Asset Management
IBM Maximo Application Suite
Oracle Banking Platform
Oracle Retail Returns Management
Oracle Retail Central Office
Oracle Retail Back Office
Solaris Cluster
Oracle WebLogic Server

How to mitigate CVE-2022-29577

Install updates from vendor's website.

IBM Maximo Asset Management - addressed in versions 7.6.1.2.29, 7.6.1.3.4
IBM Maximo Application Suite - update to 8.4.6

External References

Related Security Bulletins