{"id":"CVE-2022-21445","kind":"vulnerability","aliases":["CVE-2022-21445"],"related":[],"title":"Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component:…","description":"Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces).  Supported versions that are affected are 12.2.1.3.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF).  Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle ADF Faces, a Java UI library shipped inside Oracle JDeveloper, deserializes untrusted data without checking it. An unauthenticated remote attacker can send crafted input and run code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-09-18T00:00:00+00:00","products":[{"name":"Oracle ADF Faces","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"oracle application development framework","fixed":[],"affected":"= 12.2.1.3.0","ecosystem":"vendor"},{"name":"oracle application development framework","fixed":[],"affected":"= 12.2.1.4.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","oracle-adf","oracle-jdeveloper","package","self-hosted"],"not_affected_if":["no-adf-faces","no-jdeveloper-distribution"],"how_to_check":null,"fix":"Apply the Oracle security update for ADF Faces per vendor instructions, or stop using the affected product if no mitigation is available.","status":"open","published_at":"2022-04-19T21:15:15+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:36+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:56:36Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle security update for ADF Faces per vendor instructions, or stop using the affected product if no mitigation is available.","reach":"internet","impact":"high","summary":"Oracle ADF Faces, a Java UI library shipped inside Oracle JDeveloper, deserializes untrusted data without checking it. An unauthenticated remote attacker can send crafted input and run code on the server.","category":"package","who_cares":["java","oracle-adf","oracle-jdeveloper","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the server","analyst_note":"Find the exact affected and fixed ADF Faces versions and the Oracle Security Alert/CPU advisory for January 2022 (the CVE-2022-21445 entry on Oracle's advisory page) to write how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-adf-faces","no-jdeveloper-distribution"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000481,"input_tokens":2832,"output_tokens":395,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':16A,19A '-21445':17A,20A '/av':169C '12.2.1.3.0':97C '12.2.1.4.0':99C '3.1':156C,168C '9.8':159C 'access':108C 'adf':8A,22A,36B,45B,82C,89C,117C,132C,138C 'advisor':151C 'affect':95C 'allow':103C 'applic':5A,79C,114C,129C,135C 'application':25A,29A 'attack':64B,105C,119C 'avail':163C 'base':157C 'check':59B 'code':71B 'compon':14A,88C 'compromis':112C 'confidenti':160C 'craft':67B 'cve':15A,18A 'cvss':155C,165C,167C 'data':57B 'deseri':55B 'detail':154C 'develop':6A,80C,115C,130C,136C 'development':26A,30A 'download':140C 'easili':100C 'exploit':32B,101C 'face':46B,90C 'faces':23A 'framework':7A,27A,31A,81C,116C,131C,137C 'fusion':12A,86C,148C 'h':177C 'h/a':176C 'h/i':175C 'host':43B 'http':110C 'impact':164C 'input':68B 'insid':52B 'integr':161C 'java':33B,48B 'jdevelop':39B,54B,143C 'l/pr':171C 'librari':50B 'middlewar':13A,87C,149C 'n/ac':170C 'n/s':173C 'n/ui':172C 'network':107C 'note':133C 'oracl':4A,11A,35B,38B,44B,53B,78C,85C,113C,128C,134C,142C 'oracle':21A,24A,28A 'oracle-adf':34B 'oracle-jdevelop':37B 'packag':40B 'patch':150C 'pleas':145C 'product':9A,83C,144C 'refer':146C 'remot':63B 'result':124C 'run':70B 'score':158C 'self':42B 'self-host':41B 'send':66B 'server':74B 'ship':51B 'success':118C 'support':91C 'takeov':126C 'u/c':174C 'ui':49B 'unauthent':62B,104C 'untrust':56B 'vector':166C 'version':92C 'via':109C,141C 'vulner':1A,75C,102C,122C 'without':58B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-04-19T21:15:15+00:00","kev":{"dateAdded":"2024-09-18","dueDate":"2024-10-09","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-21445","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21445","severity":null,"published_at":"2024-09-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-21445","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21445","severity":null,"published_at":"2022-04-19T21:15:15+00:00","modified_at":"2026-06-17T04:26:16+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}