PT-2020-2623 · Oracle · Oracle Retail Customer Management/Segmentation Foundation

Published 2020-04-14 · Updated 2020-04-16 · CVE-2020-2953

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Retail Customer Management and Segmentation Foundation version 18.0

Description The issue is related to inadequate access control in the Promotions component, allowing an unauthenticated attacker with network access via HTTP to compromise the Oracle Retail Customer Management and Segmentation Foundation. Successful attacks can result in the takeover of the application.

Recommendations For version 18.0, update to a version that addresses the access control issue in the Promotions component to prevent potential takeover of the application. As a temporary workaround, consider restricting access to the Promotions component until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2020-02660

CVE-2020-2953

Affected Products

Oracle Retail Customer Management/Segmentation Foundation

References · 4

• https://bdu.fstec.ru/vul/2020-02660 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-2953 · Security Note
• https://oracle.com/security-alerts/cpuapr2020.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2953 · Vendor Advisory