CVE-2022-35587: 
PHP vulnerability analysis and mitigation

CVE-2021-35587 is a critical vulnerability in Oracle Access Manager (OAM), a component of Oracle Fusion Middleware. The vulnerability affects OAM versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0. It was initially disclosed in January 2022 as part of Oracle's Critical Patch Update. The vulnerability carries a CVSS score of 9.8, indicating its critical severity (Oracle CPE, NIST NVD).

The vulnerability allows an unauthenticated attacker with network access via HTTP to completely compromise Oracle Access Manager instances. It specifically affects the OpenSSO Agent component and enables remote command execution without requiring authentication. The vulnerability has been assigned a CVSS Base Score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NIST NVD).

Successful exploitation of CVE-2021-35587 can result in complete takeover of Oracle Access Manager instances. Given that OAM is an enterprise-level security application providing web-perimeter security functions and web single sign-on services, compromise could have severe consequences for affected organizations. The vulnerability potentially allows attackers to create users with any privileges or execute arbitrary code on the victim's server (Hacker News).

Oracle released patches for this vulnerability in their January 2022 Critical Patch Update. Organizations are strongly advised to apply these security updates immediately. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and requires federal agencies to apply vendor patches by December 19, 2022 (Hacker News).

The vulnerability has gained significant attention from the cybersecurity community, particularly after CISA added it to their KEV Catalog on November 28, 2022, due to evidence of active exploitation. Security researchers and threat intelligence firms have been actively monitoring and reporting on exploitation attempts in the wild (Censys).