PT-2020-2135 · Oracle · Enterprise Manager Base Platform

Published 2020-04-15 · Updated 2020-04-16 · CVE-2020-2961

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Enterprise Manager Base Platform versions 13.2.0.0 through 13.3.0.0

Description The issue is related to insufficient access control in the Discovery Framework component of the Enterprise Manager Base Platform, allowing a remote attacker to modify, add, or delete data, or gain unauthorized access to protected information via the HTTP protocol. This can result in the takeover of the Enterprise Manager Base Platform.

Recommendations For versions 13.2.0.0 and 13.3.0.0, update to a version that addresses the insufficient access control issue in the Discovery Framework component to prevent unauthorized access and potential takeover of the Enterprise Manager Base Platform.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2020-02024

CVE-2020-2961

Affected Products

Enterprise Manager Base Platform

References · 4

• https://osv.dev/vulnerability/CVE-2020-2961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2961 · Security Note
• https://oracle.com/security-alerts/cpuapr2020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02024 · Security Note