Oracle Commerce: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 9.8
  CVE-2022-22965 Exploited Public exploit Scanner template EPSS 100%

  Remote Code Execution in Spring Framework

  A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…

  libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring-webflux Debian Ubuntu Maven
  Apr 1, 2022

  KEV Apr 4, 2022
• High 7.5
  CVE-2020-36518 Public exploit

  Deeply nested json in jackson-databind

  jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

  management-api-for-apache-cassandra-5.0 com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Wolfi Maven
  Mar 11, 2022

Revision history

1. 2023-01-17 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2023 - Appendix Oracle Commerce vom 2023-01-17
  https://www.oracle.com/security-alerts/cpujan2023.html#AppendixOCOM