PT-2020-1406 · Oracle · Enterprise Manager Base Platform

Published 2020-01-14 · Updated 2022-07-28 · CVE-2020-2646

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Enterprise Manager Base Platform versions 12.1.0.5 through 13.3.0.0

Description The issue is related to inadequate access control in the Command Line Interface component of the Enterprise Manager Base Platform. It allows a remote attacker to gain unauthorized access to modify, add, or delete data, or access protected information via the HTTP protocol. The vulnerability can be easily exploited by a low-privileged attacker with network access. Successful attacks require human interaction and can significantly impact additional products, resulting in unauthorized access to some data and read access to a subset of the platform's accessible data.

Recommendations For versions 12.1.0.5, 13.2.0.0, and 13.3.0.0, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the Command Line Interface component until a patch is available. Restrict access to the HTTP protocol to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00379

CVE-2020-2646

Affected Products

Enterprise Manager Base Platform

References · 5

• https://bdu.fstec.ru/vul/2020-00379 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-2646 · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2646 · Vendor Advisory
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note