CVE-2022-39412: High severity oracle access manager vulnerability

Published Oct 18, 2022

Updated

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected Software

1 affected component

Oracle Access Manager=12.2.1.4.0

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpuoct2022.html

Event History

Oct 18, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this Oracle Access Manager vulnerability?

The vulnerability ID is CVE-2022-39412.

What component of Oracle Fusion Middleware is affected by this vulnerability?

The Admin Console component of Oracle Access Manager is affected.

What is the severity rating of CVE-2022-39412?

CVE-2022-39412 has a severity rating of high, with a CVSS score of 7.5.

How can an attacker exploit this vulnerability?

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Access Manager.

Is there a fix available for CVE-2022-39412?

Yes, Oracle has released a security advisory with patches to address this vulnerability. Please refer to the Oracle Security Alert for more information.