CVE-2022-21558

HOCH 7.8CVE-2022-21558 · Published 19/07/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-21558 ist eine Schwachstelle (HOCH (CVSS 7.8)) in crystal ball (oracle).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.27%, höher als bei 19.6% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
crystal ball oracle	`≥ 11.1.2.0.000, ≤ 11.1.2.4.900`	No fix yet

Description

Vulnerability in the Oracle Crystal Ball product of Oracle Construction and Engineering (component: Installation). Supported versions that are affected are 11.1.2.0.000-11.1.2.4.900. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Crystal Ball executes to compromise Oracle Crystal Ball. While the vulnerability is in Oracle Crystal Ball, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Crystal Ball. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

References

mandiant/Vulnerability-Disclosures · Third Party Advisory
oracle.com/security-alerts/cpujul2022.html · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free