CISA adds Oracle, SugarCRM bugs to exploited vulnerabilities list
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21587 | Unauthenticated Arbitrary File Upload in Oracle E-Business Suite | 9.8 | 98% | KEVRansomwarePoC | KEV |
| CVE-2023-22952 | Authenticated PHP Code Injection RCE in SugarCRM EmailTemplates | 8.8 | 80% | KEVPoC | KEV |
From the original article
2 min read at therecord.media
The Cybersecurity and Infrastructure Security Agency (CISA) said two vulnerabilities from Oracle and SugarCRM are actively being exploited and ordered federal civilian agencies to patch them before February 23. On Thursday, CISA added CVE-2022-21587 – affecting Oracle's E-Business suite – and CVE-2023-22952 – which affects multiple products from SugarCRM – to its Known Exploited Vulnerabilities Catalog.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.