55 lines
1.8 KiB
YAML
55 lines
1.8 KiB
YAML
id: CVE-2021-35587
|
|
|
|
info:
|
|
name: Oracle Access Manager - Remote Code Execution
|
|
author: cckuailong
|
|
severity: critical
|
|
description: |
|
|
The Oracle Access Manager portion of Oracle Fusion Middleware (component: OpenSSO Agent) is vulnerable to remote code execution. Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle Access Manager.
|
|
remediation: |
|
|
Apply the latest security patches provided by Oracle to mitigate this vulnerability.
|
|
reference:
|
|
- https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-35587
|
|
- https://www.oracle.com/security-alerts/cpujan2022.html
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2021-35587
|
|
cwe-id: CWE-502
|
|
epss-score: 0.95945
|
|
epss-percentile: 0.99267
|
|
cpe: cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: oracle
|
|
product: access_manager
|
|
shodan-query: http.title:"Oracle Access Management"
|
|
fofa-query: body="/oam/pages/css/login_page.css"
|
|
tags: cve,cve2021,oam,rce,java,unauth,oracle,kev
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- '{{BaseURL}}/oam/server/opensso/sessionservice'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "x-oracle-dms-ecid"
|
|
- "x-oracle-dms-rid"
|
|
case-insensitive: true
|
|
condition: or
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "/oam/pages/css/general.css"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|