Unauthorized Access Vulnerability in Oracle Application Express Packaged Apps

CVE-2020-14898

Summary

A vulnerability exists within Oracle Application Express Packaged Apps of Oracle Database Server that can be exploited by low privileged attackers with a valid user account. This issue, present in versions prior to 20.2, allows attackers with network access via HTTP to manipulate accessible data within packaged applications. Successful exploitation necessitates human interaction from a source other than the attacker. Consequently, this vulnerability could lead to unauthorized updates, inserts, or deletions of data, as well as unauthorized reading of sensitive information within the Oracle Application Express Packaged Apps framework. Organizations should ensure they implement proper security measures to mitigate potential risks associated with this vulnerability.

References