External risk intelligence

Oracle Application Development Framework Network Compromise

CVE advisoryKnown Exploit

CVE-2022-21445

The vulnerability affects the Oracle Application Development Framework (ADF), which is typically used to build and deploy web applications that are reachable via HTTP. Since these applications are often exposed as public-facing web services or APIs, the vulnerable component is likely to be accessible from the internet in common deployment patterns.

Deserialization

Oracle Application Development Framework

12.2.1.3.012.2.1.4.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists within Oracle Application Development Framework (ADF). This flaw allows an unauthorized individual, without needing prior authentication, to gain control over the ADF system through network access. Successful exploitation could lead to the complete takeover of the affected Oracle Application Development Framework.

Oracle Application Development Framework (ADF)
Deserialization of untrusted data
System takeover

Attack Path

How an attacker could exploit the issue

The Oracle Application Development Framework (ADF) is susceptible to a vulnerability that can allow an attacker to gain control of the system. This occurs when an unauthenticated attacker exploits the framework's deserialization process through network access. Successful exploitation can lead to a complete takeover of the ADF environment.

Network-accessible exposure
Attacker accesses via HTTP
Deserialization leads to control

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Oracle Application Development Framework (ADF) allows an attacker to completely take over the affected system. Exploitation requires no authentication and can be performed remotely over a network. The potential impact is significant, affecting confidentiality, integrity, and availability of the system.

Attackers need advanced skills.
No special access or conditions are required.
Business risk is high, requiring urgent attention.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Oracle Application Development Framework (ADF) and could allow an unauthenticated attacker to take control of the framework. Such an attack could affect the confidentiality, integrity, and availability of business data and systems. The affected versions are 12.2.1.3.0 and 12.2.1.4.0.

Find exposed assets.
Reduce exposure or isolate risk.
Apply fix, verify, and monitor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Application Development Framework (ADF)?

Oracle Application Development Framework (ADF) is a Java framework used for building enterprise applications. It is often utilized with Oracle JDeveloper to create and deploy web applications, providing tools for developers to streamline the application creation process.

What is CVE-2022-21445? What type of weakness is it?

CVE-2022-21445 is a critical vulnerability in Oracle Application Development Framework (ADF). The weakness is classified as CWE-502, which refers to the deserialization of untrusted data. This means the software improperly processes data that it receives from untrusted sources, potentially leading to security issues.

How can an attacker exploit this vulnerability?

An unauthenticated attacker with network access can exploit this vulnerability. The attack is carried out via HTTP, and it does not require any special conditions or prior access to the system. The core of the exploit involves the deserialization of untrusted data within the ADF.

Who should be concerned about this vulnerability?

Organizations using Oracle Application Development Framework (ADF) should be concerned. Halo Surface Signal indicates this vulnerability is likely externally facing because ADF is typically used for web applications that can be reached over the internet.

What are the first steps to address CVE-2022-21445?

The first steps involve identifying any Oracle Application Development Framework (ADF) instances that are accessible from the network. If possible, reduce their exposure or isolate them. Following that, apply any available patches or fixes provided by Oracle for versions 12.2.1.3.0 and 12.2.1.4.0.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.