{"id":"CVE-2022-21587","kind":"vulnerability","aliases":["CVE-2022-21587"],"related":[],"title":"Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload)","description":"Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle E-Business Suite has an unspecified flaw in Oracle Web Applications Desktop Integrator that an unauthenticated attacker can reach over HTTP. CISA lists it as actively exploited, with ransomware use noted in the catalog.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-02-02T00:00:00+00:00","products":[{"name":"Oracle E-Business Suite","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"oracle e-business suite","fixed":[],"affected":">= 12.2.3, <= 12.2.11","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","oracle-ebs","ransomware","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Check whether Oracle E-Business Suite is running and which patch level is installed; the sources do not give a file or command.","fix":"Apply Oracle's security updates for this CVE per vendor instructions, as CISA requires.","status":"open","published_at":"2022-10-18T21:15:10+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:45+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:08:45Z","model":"claude-haiku-5-5","output":{"fix":"Apply Oracle's security updates for this CVE per vendor instructions, as CISA requires.\nunknown","reach":"internet","impact":"high","summary":"Oracle E-Business Suite has an unspecified flaw in Oracle Web Applications Desktop Integrator that an unauthenticated attacker can reach over HTTP. CISA lists it as actively exploited, with ransomware use noted in the catalog.","category":"vendor","who_cares":["oracle-ebs","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker compromises the server through the Desktop Integrator component.","analyst_note":"Find Oracle's Security Alert advisory for CVE-2022-21587 to get affected and fixed versions and the exact patch and check steps; the sources give none.","how_to_check":"Check whether Oracle E-Business Suite is running and which patch level is installed; the sources do not give a file or command.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000485,"input_tokens":2815,"output_tokens":407,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':19A,22A '-21587':20A,23A '/av':151C '12.2.11':103C '12.2.3':102C '3.1':138C,150C '9.8':141C 'access':112C 'activ':70B 'affect':100C 'allow':107C 'applic':6A,55B,84C,119C,134C 'attack':61B,109C,123C 'avail':145C 'base':139C 'busi':14A,46B,92C 'business':27A,32A 'catalog':78B 'cisa':66B 'compon':16A,94C 'compromis':116C 'confidenti':142C 'cve':18A,21A 'cvss':137C,147C,149C 'desktop':7A,56B,85C,120C,135C 'e':13A,26A,31A,45B,91C 'e-busi':12A,44B,90C 'e-business':25A,30A 'easili':104C 'eb':37B 'exploit':34B,71B,105C 'flaw':51B 'h':159C 'h/a':158C 'h/i':157C 'host':41B 'http':65B,114C 'impact':146C 'integr':8A,57B,86C,121C,136C,143C 'l/pr':153C 'list':67B 'n/ac':152C 'n/s':155C 'n/ui':154C 'network':111C 'note':75B 'oracl':4A,11A,36B,43B,53B,82C,89C,117C,132C 'oracle':24A,29A 'oracle-eb':35B 'product':9A,87C 'ransomwar':38B,73B 'reach':63B 'result':128C 'score':140C 'self':40B 'self-host':39B 'success':122C 'suit':15A,47B,93C 'suite':28A,33A 'support':96C 'takeov':130C 'u/c':156C 'unauthent':60B,108C 'unspecifi':50B 'upload':17A,95C 'use':74B 'vector':148C 'vendor':42B 'version':97C 'via':113C 'vulner':1A,79C,106C,126C 'web':5A,54B,83C,118C,133C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-10-18T21:15:10+00:00","kev":{"dateAdded":"2023-02-02","dueDate":"2023-02-23","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-21587","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-21587","severity":null,"published_at":"2023-02-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-21587","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21587","severity":null,"published_at":"2022-10-18T21:15:10+00:00","modified_at":"2026-06-17T04:26:34+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}