CVE-2020-2978 - Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server

Back Back to CVE browser

MEDIUM

Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server

Published Jul 15, 2020

4.1

MEDIUM

CVSS 3.1

EPSS 1.24%

Description

Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA role account privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition. While the vulnerability is in Oracle Database - Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database - Enterprise Edition accessible data. CVSS 3.1 Base Score 4.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N).

Affected products

Vendor Oracle Corporation Product Oracle Database Default
n/a
- Version
  12.1.0.2
  Status
  affected
  Constraints
  -
- Version
  12.2.0.1
  Status
  affected
  Constraints
  -
- Version
  18c
  Status
  affected
  Constraints
  -
- Version
  19c
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oracle Corporation

Oracle Database

n/a

Version	Status	Constraints
12.1.0.2	affected	-
12.2.0.1	affected	-
18c	affected	-
19c	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (4)

http://packetstormsecurity.com/files/172183/Oracle-RMAN-Missing-Auditing.html
https://databasesecurityninja.wordpress.com/2020/12/01/cve-2020-2978-rman-audit-table-point-in-time-recovery-not-logged/
ExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22771
Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
PatchVendor Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/172183/Oracle-RMAN-Missing-Auditing.html
https://databasesecurityninja.wordpress.com/2020/12/01/cve-2020-2978-rman-audit-table-point-in-time-recovery-not-logged/		ExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22771		Advisory
https://www.oracle.com/security-alerts/cpujul2020.html		PatchVendor Advisory