CVE-2022-21511: oracle corporation database - enterprise edition
Vulnerability summary
CVE-2022-21511 is a high (CVSS 7.2) vulnerability in oracle corporation database - enterprise edition. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 19-07-2022PublishedVulnerability first disclosed.
- 24-09-2024Last modifiedVulnerability information updated.
Description
Vulnerability in the Oracle Database - Enterprise Edition Recovery component of Oracle Database Server. For supported versions that are affected see note. Easily exploitable vulnerability allows high privileged attacker having EXECUTE ON DBMS_IR.EXECUTESQLSCRIPT privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition Recovery. Successful attacks of this vulnerability can result in takeover of Oracle Database - Enterprise Edition Recovery. Note: None of the supported versions are affected. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.08%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
+0.03 pp
From 1.05% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard1 product
- keycloakAll versions (No fix recorded)
Oracle1 product
- databasena
Oracle corporation1 product
Wolfi1 product
- keycloakAll versions (No fix recorded)
4 vendors · 4 products