PT-2020-2387 · Oracle · Oracle Access Manager+1

Piotr Domirski · Published 2020-04-15 · Updated 2020-04-15 · CVE-2020-2745

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Oracle Access Manager versions 11.1.2.3.0 and 12.2.1.3.0

Description The issue is related to a resource release error in the Federation subcomponent of Oracle Access Manager, part of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager.

Recommendations For version 11.1.2.3.0, update to a version that includes the fix for this issue. For version 12.2.1.3.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Federation subcomponent until a patch is available.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2020-02357

CVE-2020-2745

Affected Products

Oracle Access Manager

Oracle Fusion Middleware

References · 4

• https://osv.dev/vulnerability/CVE-2020-2745 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2020.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2745 · Security Note
• https://bdu.fstec.ru/vul/2020-02357 · Security Note