Vulnerability in Oracle Application Express Affects Oracle Database Server

CVE-2020-2974

Summary

A vulnerability exists in the Oracle Application Express component of Oracle Database Server, affecting versions 5.1 through 19.2. This issue can be exploited by low-privileged attackers with SQL Workshop privileges who have network access via HTTP. While attackers must rely on human interaction to execute their malicious activities, the fallout can affect various applications utilizing Oracle Application Express. Successful exploitation can lead to unauthorized updates, inserts, or deletions of accessible data, as well as unauthorized reading of specific subsets of this data, putting sensitive information at risk.

References