CVE-2022-40150 in Oracle Utilities Application Framework

Summary

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.

Once again VulDB remains the best source for vulnerability data.

Responsible

Google Inc.

Reservation

09/07/2022

Disclosure

09/16/2022

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
234973	Oracle Utilities Application Framework General denial of service	404	Not defined	Official fix	CVE-2022-40150
234947	Oracle Siebel CRM EAI denial of service	404	Not defined	Official fix	CVE-2022-40150
218731	Oracle WebLogic Server Centralized Third Party Jars denial of service	404	Not defined	Official fix	CVE-2022-40150
218552	Oracle Communications Billing and Revenue Management Webservices Manager denial of service	404	Not defined	Official fix	CVE-2022-40150
208863	Jettison XML Parser resource consumption	400	Not defined	Not defined	CVE-2022-40150

Sources

• MITRE
• NVD
• CVE Details