NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2020-2555

Oracle Multiple Products Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products

VendorProductAffected versions
OracleAccess Manager
Version 11.1.2.3.0
OracleCoherence
Versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
OracleCommerce Platform
from 11.3.0 through 11.3.2
Versions 11.0.0, 11.1.0, 11.2.0
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.2.2
OracleHealthcare Data Repository
Version 7.0.1
OracleRapid Planning
Versions 12.1, 12.2
OracleRetail Assortment Planning
Versions 15.0, 16.0
OracleUtilities Framework
from 4.3.0.1.0 through 4.3.0.6.0
Versions 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2.0
OracleWebcenter Portal
Versions 12.2.1.3.0, 12.2.1.4.0

Weakness classification

CWE-502

References