Summaryinfo

A vulnerability identified as critical has been detected in Oracle Financial Services Behavior Detection Platform 8.0.8.1/8.1.1.1/8.1.2.5/8.1.2.6. Affected by this vulnerability is an unknown functionality of the component Application. The manipulation leads to an unknown weakness. This vulnerability is documented as CVE-2022-25147. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Oracle Financial Services Behavior Detection Platform 8.0.8.1/8.1.1.1/8.1.2.5/8.1.2.6 (Financial Software) and classified as critical. This issue affects some unknown functionality of the component Application. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is integrity, and availability.

The weakness was released 01/16/2024 as Oracle Critical Patch Update Advisory - January 2024. The advisory is shared at oracle.com. The identification of this vulnerability is CVE-2022-25147. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/13/2025).

The vulnerability scanner Nessus provides a plugin with the ID 239743 (TencentOS Server 4: apr-util (TSSA-2025:0144)), which helps to determine the existence of the flaw in a target environment.

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (239743) and CERT Bund (WID-SEC-2023-0245). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Apache Portable Runtime (APR)
• Open Source CentOS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• IBM WebSphere Application Server
• NetApp Data ONTAP
• NetApp StorageGRID
• Ubuntu Linux
• IBM HTTP Server
• SUSE Linux
• Oracle Linux
• IBM Security Access Manager for Enterprise Single Sign-On
• Red Hat JBoss Core Services
• HCL Commerce
• IBM Business Automation Workflow
• IBM Rational ClearCase
• IBM Tivoli Monitoring
• Trellix ePolicy Orchestrator
• Hitachi Configuration Manager
• Hitachi Ops Center
• Red Hat JBoss Web Server
• RESF Rocky Linux
• F5 BIG-IP

Productinfo

Type

• Financial Software

Vendor

• Oracle

Name

• Financial Services Behavior Detection Platform

Version

• 8.0.8.1
• 8.1.1.1
• 8.1.2.5
• 8.1.2.6

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion