Summaryinfo

A vulnerability, which was classified as very critical, has been found in Oracle Banking Corporate Lending Process Management up to 14.7.0. Impacted is an unknown function of the component Base. Performing a manipulation results in an unknown weakness. This vulnerability is identified as CVE-2022-36944. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as very critical has been found in Oracle Banking Corporate Lending Process Management up to 14.7.0 (Banking Software). This affects an unknown functionality of the component Base. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was released 01/16/2024 as Oracle Critical Patch Update Advisory - January 2024. It is possible to read the advisory at oracle.com. This vulnerability is uniquely identified as CVE-2022-36944. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 05/28/2025).

We expect the 0-day to have been worth approximately $25k-$100k.

A possible mitigation has been published immediately after the disclosure of the vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Banking Software

Vendor

• Oracle

Name

• Banking Corporate Lending Process Management

Version

• 14.0
• 14.1
• 14.2
• 14.3
• 14.4
• 14.5
• 14.6
• 14.7.0

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion