PT-2020-2530 · Oracle · Oracle Coherence

Longofo · Published 2020-04-14 · Updated 2020-04-16 · CVE-2020-2949

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0

Description The issue is related to insufficient access controls in the Caching, CacheStore, and Invocation components of Oracle Coherence. This can be exploited by a remote attacker to gain unauthorized access to protected information via the HTTP protocol. Successful attacks may result in unauthorized read access to a subset of Oracle Coherence accessible data.

Recommendations For version 3.7.1.0, update to a version that includes the necessary security fixes. For version 12.1.3.0.0, apply the recommended security patches to resolve the issue. For version 12.2.1.3.0, consider restricting access to the Caching, CacheStore, and Invocation components until a patch is available. For version 12.2.1.4.0, disable the vulnerable components temporarily as a workaround until an official fix is released.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2020-02541

CVE-2020-2949

Affected Products

Oracle Coherence

References · 4

• https://osv.dev/vulnerability/CVE-2020-2949 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02541 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-2949 · Security Note
• https://oracle.com/security-alerts/cpuapr2020.html · Vendor Advisory