{"id":"CVE-2022-21500","published":"2022-05-19T23:55:08Z","modified":"2024-09-24T20:05:17Z","title":"Vulnerability in Oracle E-Business Suite (component: Manage Proxies)","vendor":"Oracle Corporation","product":"User Management","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"User Management","versions":["12.2.4-12.2.11"]}],"description":{"text":"Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data. Note: Authentication is required for successful attack, however the user may be self-registered. <br> <br>Oracle E-Business Suite 12.1 is not impacted by this vulnerability. Customers should refer to the Patch Availability Document for details. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in the Manage Proxies component of Oracle E-Business Suite version 12.2, under the User Management product area. An unauthenticated attacker with network access over HTTP can exploit it with low complexity and no user interaction to gain unauthorized access to critical data or, in some cases, all data accessible through Oracle E-Business Suite, although the attacker may need to first self-register a user account.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:02Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.71703,"percentile":0.99421,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-12-08","exploitedFirstSeen":"2023-12-08","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-08&host_type=src&vulnerability=cve-2022-21500","date":"2023-12-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-21&host_type=src&vulnerability=cve-2022-21500","date":"2024-01-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2022-21500","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2022-21500","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2022-21500","date":"2024-01-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-28&host_type=src&vulnerability=cve-2022-21500","date":"2024-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-30&host_type=src&vulnerability=cve-2022-21500","date":"2024-01-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-31&host_type=src&vulnerability=cve-2022-21500","date":"2024-01-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-01&host_type=src&vulnerability=cve-2022-21500","date":"2024-02-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-08&host_type=src&vulnerability=cve-2022-21500","date":"2024-02-08"}],"evidenceTotal":385,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Oracle E-Business Suite Information Disclosure Vulnerability","url":"https://otx.alienvault.com/pulse/628c9b8995ee5babc7d8408b","created":"2022-05-24"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.oracle.com/security-alerts/alert-cve-2022-21500.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-26724","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26724","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-06-09","earliestUrl":"https://github.com/Cappricio-Securities/CVE-2022-21500","repos":[{"name":"Cappricio-Securities/CVE-2022-21500","url":"https://github.com/Cappricio-Securities/CVE-2022-21500","stars":1,"created":"2024-06-09"}]},"nuclei":[{"id":"CVE-2022-21500","name":"Oracle E-Business Suite <=12.2 - Authentication Bypass","severity":"high","path":"http/cves/2022/CVE-2022-21500.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21500.yaml"}],"first":{"date":"2024-06-09","source":"PoC-in-GitHub","url":"https://github.com/Cappricio-Securities/CVE-2022-21500"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-05-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-21500","provenance":"source"},{"date":"2023-12-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-08&host_type=src&vulnerability=cve-2022-21500","provenance":"source"},{"date":"2024-06-09","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Cappricio-Securities/CVE-2022-21500","provenance":"source"}],"speed":{"daysToPublicExploit":752,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1058 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9942"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}