PT-2020-3866 · Oracle · Oracle Commerce Platform

Spyridon Chatzimichail · Published 2020-07-15 · Updated 2020-07-20 · CVE-2020-14533

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Oracle Commerce Platform versions prior to 11.3.1 Oracle Commerce Platform version 11.1 Oracle Commerce Platform version 11.2

Description: The issue is related to insufficient input validation in the Dynamo Application Framework component of the Oracle Commerce Platform. This allows a remote attacker with high privileges and network access via HTTP to compromise the platform. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized update, insert, or delete access to some of the platform's accessible data, as well as unauthorized read access to a subset of the platform's accessible data.

Recommendations: For Oracle Commerce Platform versions prior to 11.3.1, update to version 11.3.1 or later to resolve the issue. For Oracle Commerce Platform version 11.1, update to version 11.3.1 or later to resolve the issue. For Oracle Commerce Platform version 11.2, update to version 11.3.1 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-04258

CVE-2020-14533

Affected Products

Oracle Commerce Platform

References · 5

• https://oracle.com/security-alerts/cpujul2020.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14533 · Security Note
• https://bdu.fstec.ru/vul/2020-04258 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020071601 · Note