CVE-2022-21473 (CNNVD-202204-3776)
中文标题:
Oracle Financial Services Applications 输入验证错误漏洞
英文标题:
Vulnerability in the Oracle Banking Treasury Management product of Oracle Financial Services Applica...
漏洞描述
中文描述:
Oracle Financial Services Applications是美国甲骨文（Oracle）公司的一套金融服务软件。该产品包括核心银行、网上银行和财产管理等。FLEXCUBE Universal Banking是其中的一个互联网和移动银行业务解决方案组件。 Oracle Financial Services Applications 存在安全漏洞，该漏洞允许通过 HTTP 进行网络访问的低权限攻击者破坏 Oracle Banking Treasury Management。成功的攻击需要来自攻击者以外的人的人机交互。成功攻击此漏洞可能导致对关键数据或所有 Oracle Banking Treasury Management 可访问数据的未授权创建、删除或修改访问，以及对 Oracle Banking Treasury Management 可访问数据子集的未授权读取访问以及导致部分拒绝的未授权能力Oracle Banking Treasury Management 的服务（部分 DOS）。
英文描述:
Vulnerability in the Oracle Banking Treasury Management product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Treasury Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Banking Treasury Management accessible data as well as unauthorized read access to a subset of Oracle Banking Treasury Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Banking Treasury Management. CVSS 3.1 Base Score 5.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L).
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Oracle Corporation | Banking Treasury Management | 14.5 | - | - |
cpe:2.3:a:oracle_corporation:banking_treasury_management:14.5:*:*:*:*:*:*:*
|
| oracle | banking_treasury_management | 14.5 | - | - |
cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2022-21473 |
2025-11-11 15:21:16 | 2025-11-11 07:37:16 |
| NVD | nvd_CVE-2022-21473 |
2025-11-11 14:58:17 | 2025-11-11 07:45:33 |
| CNNVD | cnnvd_CNNVD-202204-3776 |
2025-11-11 15:10:52 | 2025-11-11 07:57:15 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 输入验证错误
- cnnvd_id: 未提取 -> CNNVD-202204-3776
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']