Unauthorized Access Vulnerability in Oracle E-Business Suite by Oracle
CVE-2020-2666

5.3MEDIUM

Key Information:

Vendor

Oracle
Status
Applications Framework
Vendor
CVE Published:
15 January 2020

What is CVE-2020-2666?

A vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite allows unauthenticated attackers to exploit file upload functionalities. This issue affects versions 12.2.5 through 12.2.9, enabling attackers with network access via HTTPS to gain unauthorized update, insert, or delete privileges on accessible data within the framework. Organizations using the affected versions are encouraged to implement the recommended patches to safeguard their systems against this potential exploitation.

Affected Version(s)

Applications Framework 12.2.5-12.2.9

References

https://www.oracle.com/security-alerts/cpujan2020.html
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.