Vulnerability in the Oracle Communications Operations Monitor product of Oracle…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affected are 3.4, 4.2, 4.3, 4.4 and 5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Operations Monitor. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Operations Monitor, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Operations Monitor accessible data as well as unauthorized read access to a subset of Oracle Communications Operations Monitor accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Oracle | Communications Operations Monitor | 3.4; 4.2; 4.3; 4.4; 5.0 | — | No fix listed | CNA |
- Communications Operations Monitor VendorOracle Affected 3.4; 4.2; 4.3; 4.4; 5.0 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* | 3.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:* | 4.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:* | 4.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Oracle
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21397
- 2026-10-03 Alias added: GHSA-3c62-2g9v-gfg6
References
More Oracle Communications Operations Monitor vulnerabilities
- TI-2020-08897 Potential XSS vulnerability in jQuery KEVCVSS 3.1MEDIUM 6.9
- TI-2021-20274 Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier CVSS 3.1CRITICAL 9.8
- TI-2021-19915 Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier CVSS 3.1HIGH 8.2
- TI-2018-07980 Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis… CVSS 3.0CRITICAL 9.8
- TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
- TI-2022-08549 Lua scripts can be manipulated to overcome ACL rules in Redis CVSS 3.1HIGH 7.8
Sources
- CVE-2022-21397 · CVE Program
- CVE-2022-21397 · NVD
- FIRST EPSS
- GHSA-3c62-2g9v-gfg6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences