PT-2020-1301 · Oracle · Oracle Flexcube Investor Servicing

Alexander Kornbrust · Published 2020-01-14 · Updated 2022-07-28 · CVE-2020-2723

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle FLEXCUBE Investor Servicing versions 12.1.0 through 12.4.0 Oracle FLEXCUBE Investor Servicing versions 14.0.0 through 14.1.0

Description The issue is related to inadequate access control in the Infrastructure component of Oracle FLEXCUBE Investor Servicing, allowing an attacker to compromise the system via HTTP protocol. Successful attacks can result in unauthorized access to critical data, as well as unauthorized update, insert, or delete access to some data.

Recommendations For versions 12.1.0 through 12.4.0, update to a version outside of this range to resolve the issue. For versions 14.0.0 through 14.1.0, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the Infrastructure component until a patch is available. Restrict access to sensitive data and implement additional security measures to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00201

CVE-2020-2723

Affected Products

Oracle Flexcube Investor Servicing

References · 5

• https://bdu.fstec.ru/vul/2020-00201 · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2723 · Security Note
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note