CURRENT ACTIVITIES

Threat Actors exploiting RCE vulnerability in Oracle Fusion Middle Ware

Indian - Computer Emergency Response Team (cert-in.org.in)

It has been reported that the threat actors are exploiting remote code execution vulnerability in Oracle Fusion Middle Ware.

Software Affected

Oracle Access Manager (OAM) versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0

Description

Oracle Access Manager is a software extensively used by businesses for single sign-on (SSO) as part of the Oracle Fusion Middleware suite.

This vulnerability exists in OpenSSO Agent component of the Oracle Access Manager product due to improper input validation. Successful exploitation of this vulnerability could allow an unauthenticated attacker with network access via HTTP to take control of Oracle Access Manager.

Note: This vulnerability is being exploited in the wild. Users are advised to apply patches urgently.

Solution

Apply appropriate updates as mentioned by the vendor.

Vendor Information

Oracle

Reference

Oracle

CERT-In

CVE Name

CVE-2021-35587