PT-2020-1534 · Oracle · Oracle Database Server+1

Alexander Kornbrust · Published 2020-01-14 · Updated 2022-10-25 · CVE-2020-2527

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.1.0.2, 12.2.0.1, 18c, and 19c

Description The issue is related to a vulnerability in the Core RDBMS component of Oracle Database Server, allowing a high-privileged attacker with Create Index and Create Table privileges and network access via OracleNet to compromise Core RDBMS. This can result in unauthorized read access to a subset of Core RDBMS accessible data. The vulnerability may significantly impact additional products.

Recommendations For versions 12.1.0.2, 12.2.0.1, 18c, and 19c, consider restricting access to the Core RDBMS component to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the use of Create Index and Create Table privileges to reduce the attack surface. Restrict network access via OracleNet to the Core RDBMS component to prevent remote exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00527

CVE-2020-2527

Affected Products

Oracle Database

Oracle Database Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-2527 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2527 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00527 · Security Note
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note