{"id":"CVE-2022-21445","published":"2022-04-19T21:15:15Z","modified":"2026-06-17T04:26:16Z","title":"Oracle ADF Faces Deserialization of Untrusted Data Vulnerability","vendor":"Oracle","product":"ADF Faces","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces).  Supported versions that are affected are 12.2.1.3.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF).  Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"A deserialization of untrusted data flaw in the ADF Faces component of Oracle Application Development Framework (ADF), part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can exploit it with low complexity and no user interaction to take over the Oracle Application Development Framework (ADF) installation.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:01Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.62478,"percentile":0.99187,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2024-09-18","dueDate":"2024-10-09","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.oracle.com/security-alerts/cpuapr2022.html  ;  https://nvd.nist.gov/vuln/detail/CVE-2022-21445","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-10-08","exploitedFirstSeen":"2023-10-08","ransomware":false,"evidence":[{"url":"https://www.secureworks.com/-/media/Files/US/Reports/state%20of%20the%20threat/secureworks-state-of-the-threat-report-2024.ashx","date":"2023-10-08"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-09-18"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Vendor Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21445","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated network HTTP attack on exposed app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP","start":198,"end":291}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: takeover implies code execution via deserialization","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework","start":355,"end":462}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-26669","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26669","exploited":true,"exploitedSince":"2024-09-18","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2024-03-12","earliestUrl":"https://github.com/hienkiet/CVE-2022-21445-for-12.2.1.3.0-Weblogic","repos":[{"name":"hienkiet/CVE-2022-21445-for-12.2.1.3.0-Weblogic","url":"https://github.com/hienkiet/CVE-2022-21445-for-12.2.1.3.0-Weblogic","stars":5,"created":"2024-03-12"},{"name":"NeCr00/CVE-2022-21445","url":"https://github.com/NeCr00/CVE-2022-21445","stars":5,"created":"2026-02-27"}]},"first":{"date":"2024-03-12","source":"PoC-in-GitHub","url":"https://github.com/hienkiet/CVE-2022-21445-for-12.2.1.3.0-Weblogic"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2022-04-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21445","provenance":"source"},{"date":"2023-10-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.secureworks.com/-/media/Files/US/Reports/state%20of%20the%20threat/secureworks-state-of-the-threat-report-2024.ashx","provenance":"source"},{"date":"2024-03-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/hienkiet/CVE-2022-21445-for-12.2.1.3.0-Weblogic","provenance":"source"},{"date":"2024-09-18","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-09-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26669","provenance":"source"}],"speed":{"daysToPublicExploit":693,"firstExploitFrom":"PoC-in-GitHub","daysToKev":883},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1120 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.84,"detail":"percentile 0.9919"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}