PT-2020-1579 · Oracle · Oracle Hospitality Opera 5

Daniel Le Souef + 1 · Published 2020-01-14 · Updated 2022-07-08 · CVE-2020-2675

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Opera 5 version 5.5

Description The issue is related to inadequate access control in the Oracle Hospitality Opera 5 product, allowing a remote attacker to gain unauthorized access to protected information or modify, add, or delete data using the HTTP protocol. This can result in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete access to some accessible data.

Recommendations For Oracle Hospitality Opera 5 version 5.5, update the software to a version that addresses the inadequate access control issue. As a temporary workaround, consider restricting access to the login component to minimize the risk of exploitation. Avoid using the HTTP protocol for sensitive operations until the issue is resolved.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-00655

CVE-2020-2675

Affected Products

Oracle Hospitality Opera 5

References · 5

• https://osv.dev/vulnerability/CVE-2020-2675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2675 · Security Note
• https://bdu.fstec.ru/vul/2020-00655 · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
• https://oracle.com/security-alerts/public-vuln-to-advisory-mapping.html · Note