Input Validation Flaw in Oracle CRM Technical Foundation Affects Oracle E-Business Suite
CVE-2020-2596

4.7MEDIUM

Key Information:

Vendor
Oracle
Status
Crm Technical Foundation
Vendor
CVE Published:
15 January 2020

Summary

An input validation vulnerability exists in Oracle CRM Technical Foundation, part of Oracle E-Business Suite, which could allow an unauthenticated attacker to compromise the software when network access is available via HTTPS. Exploiting this vulnerability requires human interaction and, although primarily targeting Oracle CRM, it could adversely impact associated products by enabling unauthorized modifications to sensitive data. Affected versions include 12.1.3 and 12.2.3 through 12.2.9, heightening the risk of data integrity compromise.

Affected Version(s)

CRM Technical Foundation 12.1.3

CRM Technical Foundation 12.2.3-12.2.9

References

https://www.oracle.com/security-alerts/cpujan2020.html
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.