Vulnerability in Oracle Application Express of Oracle Database Server
CVE-2020-2975

5.4MEDIUM

Key Information:

Vendor
Oracle
Status
Application Express
Vendor
CVE Published:
15 July 2020

Summary

A vulnerability exists in the Oracle Application Express component of Oracle Database Server, affecting versions 5.1 through 19.2. This issue allows a low-privilege attacker with SQL Workshop access and network capabilities via HTTP to compromise the application. While exploitation requires human interaction from a third party, successful attacks can lead to unauthorized updates, inserts, or deletions of accessible data within Oracle Application Express. Moreover, attackers may gain unauthorized read access to sensitive information, potentially impacting additional associated products.

Affected Version(s)

Application Express 5.1-19.2

References

https://www.oracle.com/security-alerts/cpujul2020.html
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.