{"history":[{"alert":0,"cve":"CVE-2022-21587","id":22260,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.98342, \"percentile\": 0.99918}"},{"alert":0,"cve":"CVE-2022-21587","id":19879,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.98342, \"percentile\": 0.99917}"},{"alert":0,"cve":"CVE-2022-21587","id":17845,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.98342, \"percentile\": 0.99917}"},{"alert":0,"cve":"CVE-2022-21587","id":15909,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.98342, \"percentile\": 0.99917}"},{"alert":0,"cve":"CVE-2022-21587","id":13887,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.98342, \"percentile\": 0.99917}"},{"alert":0,"cve":"CVE-2022-21587","id":11669,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.98342, \"percentile\": 0.99917}"},{"alert":0,"cve":"CVE-2022-21587","id":9655,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.98342, \"percentile\": 0.99917}"},{"alert":1,"cve":"CVE-2022-21587","id":8339,"kind":"cna","observed_at":1793852400,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-03T02:46:38.486Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_transferred\"], \"url\": \"https://www.oracle.com/security-alerts/cpuoct2022.html\"}, {\"tags\": [\"x_transferred\"], \"url\": \"http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2022-21587\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2024-09-25T19:00:54.227415Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2023-02-02\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21587\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-306\", \"description\": \"CWE-306 Missing Authentication for Critical Function\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:15:33.318Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21587\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2023-02-02T00:00:00.000Z\", \"value\": \"CVE-2022-21587 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"Web Applications Desktop Integrator\", \"vendor\": \"Oracle Corporation\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.2.3-12.2.11\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator.\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2023-03-01T00:00:00.000Z\", \"orgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"shortName\": \"oracle\"}, \"references\": [{\"url\": \"https://www.oracle.com/security-alerts/cpuoct2022.html\"}, {\"url\": \"http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html\"}]}}, \"cveMetadata\": {\"assignerOrgId\": \"43595867-4340-4103-b7a2-9a5208d29a85\", \"assignerShortName\": \"oracle\", \"cveId\": \"CVE-2022-21587\", \"datePublished\": \"2022-10-18T00:00:00.000Z\", \"dateReserved\": \"2021-11-15T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:15:33.318Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2022-21587","id":7203,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.98342, \"percentile\": 0.99917}"},{"alert":0,"cve":"CVE-2022-21587","id":4980,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.98342, \"percentile\": 0.99918}"},{"alert":0,"cve":"CVE-2022-21587","id":2762,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.98342, \"percentile\": 0.99918}"},{"alert":1,"cve":"CVE-2022-21587","id":894,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2022-21587\", \"cwes\": [\"CWE-306\"], \"dateAdded\": \"2023-02-02\", \"dueDate\": \"2023-02-23\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"https://www.oracle.com/security-alerts/cpuoct2022.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-21587\", \"product\": \"E-Business Suite\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.\", \"vendorProject\": \"Oracle\", \"vulnerabilityName\": \"Oracle E-Business Suite Unspecified Vulnerability\"}"}],"record":{"affected":[{"product":"Web Applications Desktop Integrator","vendor":"Oracle Corporation","versions":[{"status":"affected","version":"12.2.3-12.2.11"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-03T02:46:38.486Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://www.oracle.com/security-alerts/cpuoct2022.html"},{"tags":["x_transferred"],"url":"http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2022-21587","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2024-09-25T19:00:54.227415Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2023-02-02","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21587"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-21T23:15:33.318Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21587"}],"timeline":[{"lang":"en","time":"2023-02-02T00:00:00.000Z","value":"CVE-2022-21587 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Web Applications Desktop Integrator","vendor":"Oracle Corporation","versions":[{"status":"affected","version":"12.2.3-12.2.11"}]}],"descriptions":[{"lang":"en","value":"Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator.","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2023-03-01T00:00:00.000Z","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle"},"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2022.html"},{"url":"http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html"}]}},"cveMetadata":{"assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","assignerShortName":"oracle","cveId":"CVE-2022-21587","datePublished":"2022-10-18T00:00:00.000Z","dateReserved":"2021-11-15T00:00:00.000Z","dateUpdated":"2025-10-21T23:15:33.318Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794327601,"cve":"CVE-2022-21587","description":"Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","epss":{"date":"2026-11-12","epss":0.98342,"percentile":0.99918},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2022-21587","cwes":["CWE-306"],"dateAdded":"2023-02-02","dueDate":"2023-02-23","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"https://www.oracle.com/security-alerts/cpuoct2022.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-21587","product":"E-Business Suite","requiredAction":"Apply updates per vendor instructions.","shortDescription":"Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.","vendorProject":"Oracle","vulnerabilityName":"Oracle E-Business Suite Unspecified Vulnerability"},"kev_checked":1794522003,"products":"Oracle Corporation Web Applications Desktop Integrator","references":["https://www.oracle.com/security-alerts/cpuoct2022.html","http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21587"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"oracle","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Oracle E-Business Suite Unspecified Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}