CISA adds Oracle, SugarCRM bugs to its Known Exploited Vulnerabilities Catalog

Oracle E-Business Suite versions 12.2.3 through 12.2.11 contain a critical, unauthenticated arbitrary file upload flaw (CWE-306, missing authentication) in the Upload component of the Web Applications Desktop Integrator. Because exploitation requires no credentials and no user interaction, any attacker with HTTP network access to the affected component can trigger the flaw remotely and achieve takeover of Oracle Web Applications Desktop Integrator, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 9.8). Organizations running any affected E-Business Suite 12.2 release are exposed, particularly where EBS interfaces are reachable from the internet. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-02-02 with known ransomware use, EPSS assigns a 98.3% probability of exploitation within 30 days, and exploitation attempts were observed after a public proof-of-concept was released.

Do: Apply the Oracle Critical Patch Update that addresses CVE-2022-21587 (October 2022 CPU or later) on all E-Business Suite 12.2.3-12.2.11 systems, per CISA's required action. Until patched, restrict internet access to EBS, especially the Web Applications Desktop Integrator upload endpoints, and review logs and uploaded-file locations for signs of exploitation. Prioritize remediation given confirmed active exploitation and ransomware use.

CVE-2023-22952 is a remote code execution vulnerability in multiple SugarCRM products caused by missing input validation (CWE-20) that permits PHP code injection (CWE-94) through the EmailTemplates feature. An attacker with low-privilege (authenticated) access sends a crafted request to EmailTemplates that injects and executes arbitrary custom PHP code on the server. Successful exploitation yields full server-side code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8), and the associated public proof-of-concept demonstrates shell upload, creating risk of follow-on activity such as ransomware. Organizations running affected SugarCRM releases prior to 12.0 Hotfix 91155 are exposed. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2023-02-02, EPSS assigns an 80.1% probability of exploitation within 30 days (100th percentile), and trade press reported active attacks.

Do: Apply the vendor fix immediately per CISA's KEV required action — SugarCRM 12.0 Hotfix 91155 or a later patched release per vendor instructions. Audit EmailTemplates and the server filesystem for injected PHP code or uploaded webshells, and review web logs for crafted requests to EmailTemplates endpoints. Treat unpatched, internet-exposed SugarCRM instances as high priority, as ransomware use is listed as unknown and active exploitation is confirmed.