CVE-2022-21445: Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
First published: Tue Apr 19 2022(Updated: )
Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.
Credit: secalert_us@oracle.com secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle JDeveloper | =12.2.1.3.0 | |
| Oracle JDeveloper | =12.2.1.4.0 | |
| Oracle ADF Faces | ||
| Oracle Application Development Framework | =12.2.1.3.0 | |
| Oracle Application Development Framework | =12.2.1.4.0 |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the Oracle JDeveloper vulnerability?
The vulnerability ID for the Oracle JDeveloper vulnerability is CVE-2022-21445.
What is the severity of CVE-2022-21445?
The severity of CVE-2022-21445 is critical with a severity value of 9.8.
Which versions of Oracle JDeveloper are affected by CVE-2022-21445?
The versions 12.2.1.3.0 and 12.2.1.4.0 of Oracle JDeveloper are affected by CVE-2022-21445.
How can an attacker exploit CVE-2022-21445?
An attacker with network access via HTTP can exploit CVE-2022-21445.
What is the recommended action to mitigate CVE-2022-21445?
It is recommended to apply the necessary security patches provided by Oracle to mitigate CVE-2022-21445. Please refer to the reference link for more information.
- collector/nvd-index
- agent/type
- agent/severity
- agent/first-publish-date
- agent/references
- agent/remedy
- agent/author
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/title
- agent/description
- collector/nvd-cve
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/event
- collector/nvd-api
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/softwarecombine
- vendor/oracle
- canonical/oracle jdeveloper
- version/oracle jdeveloper/12.2.1.3.0
- version/oracle jdeveloper/12.2.1.4.0
- canonical/oracle adf faces
- canonical/oracle application development framework
- version/oracle application development framework/12.2.1.3.0
- version/oracle application development framework/12.2.1.4.0