CVE-2020-14734 - Vulnerability in the Oracle Text component of Oracle Database Server

Back Back to CVE browser

HIGH

Vulnerability in the Oracle Text component of Oracle Database Server

Published Oct 21, 2020

8.1

HIGH

CVSS 3.1

EPSS 1.72%

Description

Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Text. Successful attacks of this vulnerability can result in takeover of Oracle Text. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products

Vendor Oracle Corporation Product Text Default
n/a
- Version
  11.2.0.4
  Status
  affected
  Constraints
  -
- Version
  12.1.0.2
  Status
  affected
  Constraints
  -
- Version
  12.2.0.1
  Status
  affected
  Constraints
  -
- Version
  18c
  Status
  affected
  Constraints
  -
- Version
  19c
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oracle Corporation

Text

n/a

Version	Status	Constraints
11.2.0.4	affected	-
12.1.0.2	affected	-
12.2.0.1	affected	-
18c	affected	-
19c	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-6870
Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-6870		Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html		x_refsource_MISCPatchVendor Advisory