CVE-2022-36944 in Oracle Banking Corporate Lending Process Management

Summary

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

Reservation

07/27/2022

Disclosure

09/23/2022

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
251091	Oracle Banking Corporate Lending Process Management Base deserialization	502	Not defined	Official fix	CVE-2022-36944
250957	Oracle Communications Service Catalog and Design PSR Designer deserialization	502	Not defined	Official fix	CVE-2022-36944
250955	Oracle Communications BRM - Elastic Charging Engine Security deserialization	502	Not defined	Official fix	CVE-2022-36944
242483	Oracle Communications Policy Management CMP deserialization	502	Not defined	Official fix	CVE-2022-36944
234549	Oracle Communications Network Analytics Data Director Other deserialization	502	Not defined	Official fix	CVE-2022-36944
209504	Scala JAR File deserialization	502	Not defined	Official fix	CVE-2022-36944