PT-2020-2133 · Oracle · Oracle E-Business Suite Human Resources
John Simpson
·
Published
2020-04-15
·
Updated
2022-06-30
·
CVE-2020-2956
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Oracle E-Business Suite Human Resources versions 12.1.1 through 12.1.3
Oracle E-Business Suite Human Resources versions 12.2.3 through 12.2.9
Description
The issue is related to inadequate access control in the Hierarchy Diagrammers component of Oracle Human Resources, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as complete access to all accessible data. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.
Recommendations
For versions 12.1.1 through 12.1.3, update to a version outside of this range to mitigate the risk.
For versions 12.2.3 through 12.2.9, update to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting access to the Hierarchy Diagrammers component until a patch is available.
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Oracle E-Business Suite Human Resources