CISA Known Exploited Catalog Update February 2023

The US CISA adds Oracle and SugarCRM flaws, respectively tracked as CVE-2022-21587 and CVE-2023-22952, to its Known Exploited Vulnerabilities Catalog.

The CVE-2022-21587 flaw with CVSS score 9.8 affects the Oracle E-Business Suite, which is a set of enterprise applications that allows organizations automate processes such as supply chain management (SCM), enterprise resource planning (ERP), and customer relationship management (CRM).

The vulnerability resides in the Web Applications Desktop Integrator of Oracle’s enterprise product and was addressed in October 2022.

An unauthenticated attacker can easily exploit the flaw via HTTP to take over Oracle Web Applications Desktop Integrator installs. The issue impacts versions 12.2.3-12.2.11. A working PoC is released and available.

The CVE-2023-22952 flaw with CVSS score 8.8 is a Remote Code Execution vulnerability that affects multiple SugarCRM products.

CISA orders federal agencies to fix these vulnerabilities by February 23, 2023.