| Title | Oracle Access Manager - Remote Code Execution |
|---|---|
| Author | cckuailong |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. |
| Remediation | Apply the latest security patches provided by Oracle to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94234 |
| CVE ID | CVE-2021-35587 |
| CWE ID | CWE-502 |
| Shodan Query | http.title:"Oracle Access Management"http.title:"oracle access management"http.html:"/oam/pages/css/login_page.css" |
| Fofa Query | body="/oam/pages/css/login_page.css"title="oracle access management" |
| Tags | cve2021 cve oam rce java unauth oracle kev vkev vuln |
The Oracle Access Manager portion of Oracle Fusion Middleware (component: OpenSSO Agent) is vulnerable to remote code execution. Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle Access Manager.
GET /oam/server/opensso/sessionservice HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35587.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-35587.pcap
N/AN/A