CISA adds Oracle, SugarCRM bugs to exploited vulnerabilities list
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-21587 | Unauthenticated Arbitrary File Upload in Oracle E-Business Suite Oracle E-Business Suite versions 12.2.3 through 12.2.11 contain a critical, unauthenticated arbitrary file upload flaw (CWE-306, missing authentication) in the Upload component of the Web Applications Desktop Integrator. Because exploitation requires no credentials and no user interaction, any attacker with HTTP network access to the affected component can trigger the flaw remotely and achieve takeover of Oracle Web Applications Desktop Integrator, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 9.8). Organizations running any affected E-Business Suite 12.2 release are exposed, particularly where EBS interfaces are reachable from the internet. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-02-02 with known ransomware use, EPSS assigns a 98.3% probability of exploitation within 30 days, and exploitation attempts were observed after a public proof-of-concept was released. Do: Apply the Oracle Critical Patch Update that addresses CVE-2022-21587 (October 2022 CPU or later) on all E-Business Suite 12.2.3-12.2.11 systems, per CISA's required action. Until patched, restrict internet access to EBS, especially the Web Applications Desktop Integrator upload endpoints, and review logs and uploaded-file locations for signs of exploitation. Prioritize remediation given confirmed active exploitation and ransomware use. | 9.8 | 98% | KEV ransomware PoC |
| largetens of thousands of E-Business Suite deployments worldwide, with thousands of internet-exposed instances (estimate) | |
| CVE-2023-22952 | Authenticated PHP Code Injection RCE in SugarCRM EmailTemplates CVE-2023-22952 is a remote code execution vulnerability in multiple SugarCRM products caused by missing input validation (CWE-20) that permits PHP code injection (CWE-94) through the EmailTemplates feature. An attacker with low-privilege (authenticated) access sends a crafted request to EmailTemplates that injects and executes arbitrary custom PHP code on the server. Successful exploitation yields full server-side code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8), and the associated public proof-of-concept demonstrates shell upload, creating risk of follow-on activity such as ransomware. Organizations running affected SugarCRM releases prior to 12.0 Hotfix 91155 are exposed. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2023-02-02, EPSS assigns an 80.1% probability of exploitation within 30 days (100th percentile), and trade press reported active attacks. Do: Apply the vendor fix immediately per CISA's KEV required action — SugarCRM 12.0 Hotfix 91155 or a later patched release per vendor instructions. Audit EmailTemplates and the server filesystem for injected PHP code or uploaded webshells, and review web logs for crafted requests to EmailTemplates endpoints. Treat unpatched, internet-exposed SugarCRM instances as high priority, as ransomware use is listed as unknown and active exploitation is confirmed. | 8.8 | 80% | KEV PoC |
| moderate≈10k–100k users across thousands of independently deployed business instances (order-of-magnitude estimate) |
Full article529 words · extracted from therecord.media · click to collapse
The Cybersecurity and Infrastructure Security Agency (CISA) said two vulnerabilities from Oracle and SugarCRM are actively being exploited and ordered federal civilian agencies to patch them before February 23. On Thursday, CISA added CVE-2022-21587 – affecting Oracle's E-Business suite – and CVE-2023-22952 – which affects multiple products from SugarCRM – to its Known Exploited Vulnerabilities Catalog. As with all additions to the list, CISA explained that the vulnerabilities are “frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.” Oracle patched CVE-2022-21587 in October and several experts said the E-Business suite has a broad user base, making it critical for patches to be installed as soon as possible. The bug has a 9.8 CVSS score out of a possible 10 and was highlighted by the government of Singapore as a particularly dangerous bug because it is “easily exploitable.” The SugarCRM vulnerability carries a CVSS score of 8.8 but caused more talk among security experts because an exploit for the bug was released on December 30. Researchers at Censys said on January 11 that their system found 3,059 instances of SugarCRM on the internet and 354 unique IP addresses containing the exploit’s installed webshell. A security expert said on Mastodon that they saw cryptomining malware being used in association with the exploit. SugarCRM released a report on January 13 claiming that “no intrusion has been detected in any instances of Sugar Sell, Enterprise, Professional, Serve, and Ultimate software solutions running in the SugarCloud.” “The vulnerability did not impact our Sugar Market software solution,” the company said two weeks ago. Andrew Barratt, vice president at Coalfire, told The Record that SugarCRM is a hugely popular customer relations management product often used by small and medium enterprises as well as middle market organizations. “The vulnerability announced allows for remote code execution which creates substantial amounts of risk,” he said. “CRM tools typically have large amounts of both personal data and commercially sensitive information. Often these are a treasure trove of deals and opportunities. There is downstream risk though if a CRM is compromised whilst the data might be considered to belong to the user. That data is probably relevant to many of their customers creating an amplification of the issue.” Netenrich’s John Bambenek noted that the two vulnerabilities represented two very different market segments, illustrating the wide array of targets nation-states and cybercriminals now have access to. “SugarCRM is going after the small business market and those who don’t have the resourcing to pay for and fully realize the value of SalesForce,” he said. “Oracle is on the other end of that spectrum with many enterprise users. This highlights that all market segments attract APT and nation-state risks that should enforce the need to make sure updates are applied as quickly as they come out.”
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/cisa-adds-oracle-sugarcrm-bugs-to-exploited-vulnerabilities-list