PT-2020-3865 · Oracle · Oracle Commerce Platform

Spyridon Chatzimichail · Published 2020-07-15 · Updated 2020-07-20 · CVE-2020-14532

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Commerce Platform versions prior to 11.3.1

Description: The issue is related to insufficient input validation in the Dynamo Application Framework component of the Oracle Commerce Platform. It allows an unauthenticated attacker with network access via HTTP to compromise the platform. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The exploitation can result in unauthorized update, insert, or delete access to some of the Oracle Commerce Platform's accessible data.

Recommendations: For versions prior to 11.3.1, update to version 11.3.1 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-04257

CVE-2020-14532

Affected Products

Oracle Commerce Platform

References · 5

• https://oracle.com/security-alerts/cpujul2020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04257 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14532 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020071601 · Note