Lucene search

OracleCVE-2020-2673

HistoryJan 15, 2020 - 5:15 p.m.

CVE-2020-2673

2020-01-1517:15:25

oracle

web.nvd.nist.gov

cve-2020-2673

oracle

application testing suite

oracle enterprise manager

vulnerability

exploitable

http

cvss 3.0

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0.003

Percentile

68.3%

JSON

Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Oracle Flow Builder). Supported versions that are affected are 12.5.0.3, 13.1.0.1, 13.2.0.1 and 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected configurations

Nvd

Vulners

Node

oracleapplication_testing_suiteMatch12.5.0.3

oracleapplication_testing_suiteMatch13.1.0.1

oracleapplication_testing_suiteMatch13.2.0.1

oracleapplication_testing_suiteMatch13.3.0.1

VendorProductVersionCPE
oracleapplication_testing_suite12.5.0.3cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*
oracleapplication_testing_suite13.1.0.1cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*
oracleapplication_testing_suite13.2.0.1cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*
oracleapplication_testing_suite13.3.0.1cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	application_testing_suite	12.5.0.3	cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:::::::*
oracle	application_testing_suite	13.1.0.1	cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:::::::*
oracle	application_testing_suite	13.2.0.1	cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:::::::*
oracle	application_testing_suite	13.3.0.1	cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:::::::*

CNA Affected

[
  {
    "product": "Application Testing Suite",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "12.5.0.3"
      },
      {
        "status": "affected",
        "version": "13.1.0.1"
      },
      {
        "status": "affected",
        "version": "13.2.0.1"
      },
      {
        "status": "affected",
        "version": "13.3.0.1"
      }
    ]
  }
]

References

www.oracle.com/security-alerts/cpujan2020.html

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0.003

Percentile

68.3%

JSON

Related for CVE-2020-2673