Description
Oracle E-Business Suite (EBS), is an integrated set of business applications for automating customer relationship management (CRM), enterprise resource planning (ERP) and supply chain management (SCM) processes within organizations.
Oracle EBS versions 12.2.3-12.2.11 are affected by a vulnerability in the Oracle Web Applications Desktop Integrator product (component: Upload). The servlet BneAbstractXMLServlet is vulnerable to a zip slip vulnerability that allows an attacker to upload and overwrite arbitrary files.
Remediation
It's recommended to upgrade to the latest version of Oracle E-Business Suite (EBS).
References
Oracle Critical Patch Update Advisory - October 2022
CVE-2022-21587 (Oracle E-Business Suite Unauthenticated RCE)
Related Vulnerabilities
Unauthenticated remote code execution vulnerability in Confluence Server and Data Center
XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-50721)
WordPress Plugin Advanced Access Manager Arbitrary Code Execution (2.8.2)
Cisco IOS XE Web UI Implant (CVE-2023-20198)
WordPress Plugin Gantry 4 Framework Remote Command Execution (4.1.3)