PT-2020-4401 · Oracle · Oracle Database Server+1

Published 2020-10-20 · Updated 2020-10-22 · CVE-2020-14743

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c

Description: The issue is related to insufficient input validation in the Java VM component, allowing a low-privileged attacker with Create Procedure privilege and network access via multiple protocols to compromise the Java VM. This can result in unauthorized update, insert, or delete access to some Java VM accessible data. The vulnerability is difficult to exploit.

Recommendations: For versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-04929

CVE-2020-14743

Affected Products

Oracle Database

Oracle Database Server

References · 5

• https://osv.dev/vulnerability/CVE-2020-14743 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2020.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14743 · Security Note
• https://bdu.fstec.ru/vul/2020-04929 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020102104 · Note