CVE-2022-23307

high-risk
Published 2022-01-18

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Do I need to act?

~
2.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (20)

Chainsaw
Reload4J
Advanced Supply Chain Planning
Advanced Supply Chain Planning
E-Business Suite Cloud Manager And Cloud Backup Module
E-Business Suite Cloud Manager And Cloud Backup Module

Affected Vendors

Apache Oracle Qos

References (8)

Mailing List https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh
Vendor Advisory https://logging.apache.org/log4j/1.2/index.html
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujul2022.html
Mailing List https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh
Vendor Advisory https://logging.apache.org/log4j/1.2/index.html
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujul2022.html
59
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 5/34 · Minimal
Exposure 24/34 · High