Vulnerability in Oracle Database Gateway for ODBC Component

CVE-2020-2517

Summary

A vulnerability exists in the Database Gateway for ODBC component of Oracle Database Server which can be exploited by an attacker with high privileges, particularly those with Create Procedure and Create Database Link privileges. The attacker must possess network access via OracleNet to target the Database Gateway for ODBC. Successful exploitation may lead to unauthorized updates, inserts, or deletions of accessible data within this component, as well as the potential to partially disrupt services, leading to a partial denial of service situation. The affected versions include 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c. Organizations using these versions should take necessary precautions to mitigate risks associated with this vulnerability.

References