Unauthorized Access Vulnerability in Oracle Business Intelligence Enterprise Edition by Oracle
CVE-2020-2535

4.7MEDIUM

Key Information:

Vendor
Oracle
Status
Oracle Business Intelligence Enterprise Edition
Vendor
CVE Published:
15 January 2020

Summary

This security vulnerability in Oracle Business Intelligence Enterprise Edition allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to sensitive data. The attack requires human interaction from a person other than the attacker, potentially allowing for significant impacts on associated products. Systems running affected versions, such as 12.2.1.3.0 and 12.2.1.4.0, should be assessed for exposure to ensure data integrity and confidentiality.

Affected Version(s)

Oracle Business Intelligence Enterprise Edition 12.2.1.3.0

Oracle Business Intelligence Enterprise Edition 12.2.1.4.0

References

https://www.oracle.com/security-alerts/cpujan2020.html
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.