Vulnerability in Oracle Commerce_guided_search
CVE-2022-22946
In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect…
Vulnerability class: Improper Certificate Validation
EPSS: 0.048 (91.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Oracle Commerce_guided_search — versions 11.3.2
- Oracle Communications_cloud_native_core_binding_support_function — versions 22.1.3
- Oracle Communications_cloud_native_core_console — versions 22.2.0
- Oracle Communications_cloud_native_core_network_repository_function — versions 22.1.2, 22.2.0
- Oracle Communications_cloud_native_core_security_edge_protection_proxy — versions 22.1.1
- Vmware Spring_cloud_gateway — versions 3.1.0
- N/a Spring Cloud Gateway — versions Spring cloud gateway versions 3.1.x prior to 3.1.1+
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@vmware.com (x_refsource_MISC, Vendor Advisory)
- security@vmware.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-22946?
- CVE-2022-22946 is a medium-severity vulnerability in Oracle Commerce_guided_search, classified under Improper Certificate Validation. CVSS score: 5.5/10. Published 2022-03-04.
- How severe is CVE-2022-22946?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2022-22946 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.