CVE-2022-21587 Ransomware

CISA description

Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.

Required action

Apply updates per vendor instructions.

Notes & references

• https://www.oracle.com/security-alerts/cpuoct2022.html
• https://nvd.nist.gov/vuln/detail/CVE-2022-21587

Where this lands in 800-53

Vulnerability data triggers these controls during assessment and continuous monitoring.

• RA-5 · Vulnerability Monitoring and Scanning
• SI-2 · Flaw Remediation
• CM-6 · Configuration Settings
• SI-7 · Software, Firmware, and Information Integrity
• CM-8 · System Component Inventory

External lookups

• NVD · CVE-2022-21587
• CVE.org · CVE-2022-21587
• CISA KEV catalog (canonical)