Vulnerability in Oracle Application Express Affects Oracle Database Server
CVE-2020-14762

5.4MEDIUM

Key Information:

Vendor
Oracle
Status
Application Express (apex)
Vendor
CVE Published:
21 October 2020

Summary

A vulnerability exists in the Oracle Application Express component of Oracle Database Server, allowing low privileged attackers with SQL Workshop privilege to exploit this weakness via HTTP. This means that they can perform unauthorized actions such as updating, inserting, or deleting data accessible through the Oracle Application Express interface. The vulnerability necessitates human interaction, making it particularly concerning due to potential involvement from unsuspecting users. Compromises through this vulnerability can lead to significant impacts on data confidentiality and integrity, affecting not only the Application Express itself but potentially other connected products too.

Affected Version(s)

Application Express (APEX) < 20.2

References

https://www.oracle.com/security-alerts/cpuoct2020.html
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.