PT-2020-1503 · Oracle · Oracle Database Server+2

Eddie Zhu · Published 2020-01-01 · Updated 2022-07-28 · CVE-2020-2569

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Oracle Applications DBA versions 11.2.0.4 through 19c

Description The issue is related to insufficient access control in the Oracle Applications DBA component of Oracle Database Server. Exploitation of this issue can allow an attacker to modify, add, or delete data, or cause a denial of service. The vulnerability can be easily exploited by a low-privileged attacker with local logon privilege to the infrastructure where Oracle Applications DBA executes. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized access to some of Oracle Applications DBA accessible data and a partial denial of service.

Recommendations For versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c, consider restricting access to the Oracle Applications DBA component to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit local logon privileges to the infrastructure where Oracle Applications DBA executes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2020-00486

CVE-2020-2569

Affected Products

Oracle Applications

Oracle Database

Oracle Database Server

References · 5

• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2569 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00486 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-2569 · Security Note
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note