PT-2020-1308 · Oracle · Oracle Financial Services Revenue Management/Billing

Published 2020-01-14 · Updated 2021-01-13 · CVE-2020-2730

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Financial Services Revenue Management and Billing versions 2.7.0.0 through 2.8.0.0

Description The issue is related to the unlimited upload of dangerous file types in the File Upload component. This can be exploited by a remote attacker to impact data integrity or disclose protected information via the HTTP protocol. The vulnerability can be easily exploited and requires human interaction from someone other than the attacker. Successful attacks can result in unauthorized access to update, insert, or delete data, as well as unauthorized read access to a subset of the data.

Recommendations For versions 2.7.0.0, 2.7.0.1, and 2.8.0.0, consider disabling the File Upload component until a patch is available to prevent exploitation. Restrict access to the File Upload feature to minimize the risk of unauthorized data access. Avoid using the HTTP protocol for sensitive operations until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2020-00208

CVE-2020-2730

Affected Products

Oracle Financial Services Revenue Management/Billing

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-2730 · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00208 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2730 · Vendor Advisory
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note