PT-2020-3531 · Oracle · Oracle Communications Session Border Controller

Published 2020-07-15 · Updated 2020-07-17 · CVE-2020-14580

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Oracle Communications Session Border Controller versions 8.1.0 through 8.3.0

Description The issue is related to insufficient input validation in the System Admin component of the Oracle Communications Session Border Controller. This can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability can be easily exploited and requires human interaction from a person other than the attacker. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized updates, inserts, or deletes, and a partial denial of service.

Recommendations For versions 8.1.0 through 8.3.0, consider restricting access to the System Admin component via SSH to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit network access to the Oracle Communications Session Border Controller to reduce the attack surface. Additionally, monitor the system for any suspicious activity that may indicate an attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-03863

CVE-2020-14580

Affected Products

Oracle Communications Session Border Controller

References · 4

• https://osv.dev/vulnerability/CVE-2020-14580 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2020.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14580 · Security Note
• https://bdu.fstec.ru/vul/2020-03863 · Security Note