From securityweek.com
The US Cybersecurity and Infrastructure Security Agency (CISA) on Monday warned organizations that a critical Oracle Fusion Middleware vulnerability patched in early 2022 is being exploited in attacks.
The security hole, tracked as CVE-2021-35587, impacts Oracle Access Manager, which provides the Oracle Fusion Middleware single sign-on (SSO) solution. The affected product is used by many major organizations, such as VMware, Huawei, and Qualcomm, according to the researchers who found the vulnerability.
The flaw, which impacts the OpenSSO Agent component, can allow an unauthenticated attacker with network access via HTTP to take control of Oracle Access Manager. A patch was announced by Oracle in January 2022, when the company released its Critical Patch Updates.
Oracles has credited the Vietnamese researchers known as Jang (VNPT) and Peterjson (VNG Corporation) for reporting the vulnerability. The researchers published a blog post detailing their findings in March, and noted that the flaw was discovered during the analysis of what they called a ‘mega’ Fusion Middleware vulnerability that Oracle took six months to patch.