PT-2021-1805 · Oracle · Oracle Coherence

Published 2021-01-19 · Updated 2022-03-29 · CVE-2020-14756

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

Description: The issue is related to insufficient access control in the Core Components of Oracle Coherence, allowing an unauthenticated attacker with network access via IIOP, T3 protocols to compromise Oracle Coherence. Successful attacks can result in the takeover of Oracle Coherence. The vulnerability can be exploited remotely, giving the attacker full control over the application.

Recommendations: For versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, consider restricting access to the IIOP and T3 protocols until a patch is available. As a temporary workaround, consider disabling remote access to Oracle Coherence until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2021-00558

CVE-2020-14756

Affected Products

Oracle Coherence

References · 8

• 🔥 https://github.com/Y4er/CVE-2020-14756 · Exploit
• 🔥 https://github.com/somatrasss/weblogic2021 · Exploit
• https://oracle.com/security-alerts/cpujan2021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14756 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00558 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-14756 · Security Note
• https://t.me/cybersecuritytechnologies/2580 · Telegram Post