PT-2020-1533 · Oracle · Oracle Http Server

Davide Berardi · Published 2020-01-14 · Updated 2021-09-22 · CVE-2020-2530

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle HTTP Server versions 11.1.1.9.0, 12.1.3.0.0, and 12.2.1.3.0

Description The issue is related to inadequate access control in the Web Listener component of Oracle HTTP Server, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks require human interaction and may significantly impact additional products, resulting in unauthorized access to data, including update, insert, delete, and read access to some of Oracle HTTP Server's accessible data.

Recommendations For version 11.1.1.9.0, update to a newer version to mitigate the risk. For version 12.1.3.0.0, update to a newer version to mitigate the risk. For version 12.2.1.3.0, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the Web Listener component until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00526

CVE-2020-2530

Affected Products

Oracle Http Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-2530 · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00526 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2530 · Vendor Advisory
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note
• https://t.me/cvenotify/21291 · Telegram Post