PT-2020-1306 · Oracle · Oracle Identity Manager

Tom + 1 · Published 2020-01-14 · Updated 2022-10-17 · CVE-2020-2728

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager version 12.2.1.3.0

Description The issue is related to the Identity Manager product of Oracle Fusion Middleware, specifically the OIM - LDAP user and role Synch component. It allows an unauthenticated attacker with network access via HTTP to compromise Identity Manager, resulting in unauthorized access to critical data or complete access to all Identity Manager accessible data. The vulnerability is easily exploitable and can be used to disclose protected information remotely using the HTTP protocol.

Recommendations For version 12.2.1.3.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-00206

CVE-2020-2728

Affected Products

Oracle Identity Manager

References · 5

• https://osv.dev/vulnerability/CVE-2020-2728 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2728 · Security Note
• https://bdu.fstec.ru/vul/2020-00206 · Security Note
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note