Vulnerability in Oracle Database Server's Application Express Data Reporter Component

CVE-2020-14899

Summary

This vulnerability in the Oracle Application Express Data Reporter component can be exploited by low-privileged attackers with valid user accounts. By leveraging network access via HTTP, attackers can manipulate accessible data in ways that include unauthorized updates, deletions, or inserts. The attack requires human interaction, which adds a layer of complexity. Notably, while the vulnerability is centered on the Data Reporter, its exploitation can affect additional components or products within Oracle's ecosystem, potentially leading to significant data breaches.

References