PT-2020-1426 · Oracle · Oracle Enterprise Manager

Alexander Kornbrust · Published 2020-01-14 · Updated 2022-07-28 · CVE-2020-2639

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager versions 12.1.0.5, 13.2.0.0, 13.3.0.0

Description The issue is related to a vulnerability in the Enterprise Manager Base Platform product, specifically in the Host Management component. This vulnerability can be easily exploited by a high-privileged attacker with network access via HTTP, potentially leading to unauthorized access to critical data, complete access to all accessible data, and unauthorized update, insert, or delete access to some data. Additionally, it may cause a partial denial of service (DOS) of the Enterprise Manager Base Platform. The vulnerability is associated with inadequate access control.

Recommendations For versions 12.1.0.5, 13.2.0.0, and 13.3.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2020-00399

CVE-2020-2639

Affected Products

Oracle Enterprise Manager

References · 4

• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2639 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00399 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-2639 · Security Note