CVE-2022-39405: Medium severity oracle access manager vulnerability

Published Oct 18, 2022

Updated

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected Software

1 affected component

Oracle Access Manager=12.2.1.3.0

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpuoct2022.html

Event History

Oct 18, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2022-39405.

What product is affected by the vulnerability?

The Oracle Access Manager product of Oracle Fusion Middleware is affected.

What is the affected version of the Oracle Access Manager product?

The affected version is 12.2.1.3.0.

What could an attacker do with this vulnerability?

An unauthenticated attacker with network access via HTTP could compromise Oracle Access Manager.

What is the severity of CVE-2022-39405?

The severity of CVE-2022-39405 is medium with a CVSS score of 5.3.

How can I fix CVE-2022-39405 vulnerability?

Oracle has released a security patch. Please refer to the Oracle Security Advisory for details.