PT-2020-2603 · Oracle · Oracle Knowledge

Published 2020-04-15 · Updated 2020-04-15 · CVE-2020-2553

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Knowledge versions 8.6.0 through 8.6.3

Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge, resulting in unauthorized update, insert, or delete access to some of Oracle Knowledge's accessible data, as well as unauthorized read access to a subset of Oracle Knowledge's accessible data. This is due to insufficient input validation in the Information Manager Console component.

Recommendations For Oracle Knowledge versions 8.6.0 through 8.6.3, consider restricting access to the Information Manager Console component until a patch is available. As a temporary workaround, limit the use of HTTP protocol for sensitive operations to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2020-02637

CVE-2020-2553

Affected Products

Oracle Knowledge

References · 4

• https://bdu.fstec.ru/vul/2020-02637 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-2553 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2553 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2020.html · Vendor Advisory