CVE-2022-21587

Oracle E-Business Suite: Unspecified

As of , CVE-2022-21587 in Oracle E-Business Suite is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 2 February 2023
US federal deadline
23 February 202321 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Known
EPSS score
0.98Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.01 on 2 February 2023EPSS on the day CISA listed it.
Public exploit
1 Metasploit module
Fix
Vendor advice: www.oracle.comLinks below, from CISA's entry.

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.

CISA's description

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The CVE record's description, from oracle

CVE published
18 October 2022
Assigned by
oracle
CVSS
9.8 Critical (CVSS 3.1, from the CNA)
CWE-306
Missing Authentication for Critical Function
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

  • Metasploit: Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Uploadexploit module, rank excellent

E-Business Suite: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2025-61884Server-Side Request Forgery (SSRF)Oracle E-Business SuitePatch nowRansomware use, listed within a year0.96
CVE-2026-46817Improper Privilege ManagementOracle E-Business SuitePatch nowForensic triage required by CISA0.01
CVE-2025-61882UnspecifiedOracle E-Business SuitePatch this weekRansomware use; Metasploit module; EPSS 0.990.99

Read further