PT-2020-1423 · Oracle · Oracle Enterprise Manager
CVSS v2.0
8.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Oracle Enterprise Manager versions 12.1.0.5, 13.2.0.0, 13.3.0.0
Description
The issue is related to a component of the Enterprise Manager Base Platform product, specifically the Connector Framework, and is associated with inadequate access control. This allows a high-privileged attacker with network access via HTTP to compromise the Enterprise Manager Base Platform, resulting in unauthorized access to critical data, complete access to all accessible data, and the ability to update, insert, or delete some accessible data. Additionally, it can cause a partial denial of service.
Recommendations
For versions 12.1.0.5, 13.2.0.0, and 13.3.0.0, consider restricting access to the Connector Framework component to minimize the risk of exploitation until a patch is available.
As a temporary workaround, consider disabling the HTTP access to the Enterprise Manager Base Platform until the issue is resolved.
Restrict access to sensitive data and ensure that only authorized personnel have access to the Enterprise Manager Base Platform.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Oracle Enterprise Manager