PT-2020-14060 · Oracle · Netsuite Sca

Published 2020-08-26 · Updated 2020-09-08 · CVE-2020-14728

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NetSuite SCA versions Montblanc through Aconcagua, 2018.2, 2019.1, 2019.2

Description The issue affects the SuiteCommerce Advanced (SCA) component of Oracle NetSuite service, allowing a low-privileged attacker with network access via HTTP to compromise NetSuite SCA. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some of NetSuite SCA accessible data, as well as unauthorized read access to a subset of NetSuite SCA data.

Recommendations For versions Montblanc through Aconcagua, 2018.2, 2019.1, 2019.2, consider restricting access to the NetSuite SCA component until a patch is available. As a temporary workaround, consider disabling any features that allow update, insert, or delete access to sensitive data in NetSuite SCA. Restrict access to sensitive data in NetSuite SCA to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2020-14728

Affected Products

Netsuite Sca

References · 2

• https://system.netsuite.com/app/help/helpcenter.nl · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14728 · Security Note