oracle access-manager CVE-2021-35587 is a vulnerability in Oracle Access Manager
Published on January 19, 2022

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vendor Advisory NVD

Known Exploited Vulnerability

This Oracle Fusion Middleware Unspecified Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.

The following remediation steps are recommended / required by December 19, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2021-35587 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.


Products Associated with CVE-2021-35587

You can be notified by stack.watch whenever vulnerabilities like CVE-2021-35587 are published in these products:

Oracle Access Manager
 

What versions of Access Manager are vulnerable to CVE-2021-35587?