PT-2020-1307 · Oracle · Oracle Identity Manager

Devin Rosenbauer · Published 2020-01-14 · Updated 2022-10-17 · CVE-2020-2729

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager versions 11.1.2.3.0 through 12.2.1.3.0

Description The issue is related to inadequate access control in the Advanced Console component of Oracle Identity Manager. It can be exploited by a remote attacker to compromise the integrity of data or disclose protected information via the HTTP protocol. Successful attacks may result in unauthorized access to update, insert, or delete some Identity Manager data, as well as unauthorized read access to a subset of Identity Manager data.

Recommendations For versions 11.1.2.3.0 and 12.2.1.3.0, consider restricting access to the Advanced Console component until a patch is available. As a temporary workaround, limit network access via HTTP to the Identity Manager to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00207

CVE-2020-2729

Affected Products

Oracle Identity Manager

References · 5

• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2729 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2729 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00207 · Security Note
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note