PT-2020-1409 · Oracle · Oracle Retail Customer Management/Segmentation Foundation

Looke · Published 2020-01-14 · Updated 2022-07-28 · CVE-2020-2649

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Retail Customer Management and Segmentation Foundation version 16.0

Description The issue is related to insufficient access control in the Internal Operations component of the Oracle Retail Customer Management and Segmentation Foundation software. This can allow an attacker to gain unauthorized access to protected information. The vulnerability is easily exploitable and can be compromised by a low-privileged attacker with logon access to the infrastructure where the software is executed. Successful attacks can result in unauthorized read access to a subset of the software's accessible data.

Recommendations For version 16.0, update the software to a version that includes the necessary security patches to address the insufficient access control issue. As a temporary workaround, consider restricting access to the Internal Operations component to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00382

CVE-2020-2649

Affected Products

Oracle Retail Customer Management/Segmentation Foundation

References · 5

• https://bdu.fstec.ru/vul/2020-00382 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2649 · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note