Vulnerability in Oracle Communications Element Manager
CVE-2021-22112
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.033 (88.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 88.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.033 · newest: 0.033 · change: 0.000
Affected products
- Oracle Communications Element Manager
- Oracle Communications Interactive Session Recorder — versions 6.3, 6.4
- Oracle Communications Unified Inventory Management — versions 7.4.1
- Oracle Hospitality Cruise Shipboard Property Management System — versions 20.1.0
- Oracle Insurance Policy Administration — versions 11.2.0, 11.3.0
- Oracle MySQL Enterprise Monitor
- Pivotal Software Spring Security
- VMware Spring Security
- Spring Security — versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE
Public proof-of-concept exploits
References
- www.openwall.com/lists/oss-security/2021/02/19/7 (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2… (mailing-list)
- www.oracle.com/security-alerts/cpuApr2021.html (Patch, Third Party Advisory)
- tanzu.vmware.com/security/cve-2021-22112 (Vendor Advisory)
- lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52… (mailing-list)
- lists.apache.org/thread.html/ra6389b1b82108a3b6bbcd22979f7665fd437c2a3408c9509a… (mailing-list)
- lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f8… (mailing-list)
- lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82… (mailing-list)
- lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5… (mailing-list)
- lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104… (mailing-list)
Frequently asked questions
- What is CVE-2021-22112?
- CVE-2021-22112 is a high-severity vulnerability in Oracle Communications Element Manager. CVSS score: 8.8/10. Published 2021-02-23.
- How severe is CVE-2021-22112?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2021-22112 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.