← Back

CVE-2020-2555

nvd nist
Published: Jan 15, 2020Modified: Oct 27, 2025CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected (22)

Oracle
9 products
Access Manager
Coherence
Commerce Platform
Communications Diameter Signaling Router
Healthcare Data Repository
Rapid Planning
Retail Assortment Planning
Utilities Framework
Webcenter Portal
Configuration A
22 vulnerable
Vulnerable SoftwareAffected Versions
Access Manager
Version 11.1.2.3.0
Oracle
Coherence
Version 12.1.3.0.0
Coherence
Version 12.2.1.3.0
Coherence
Version 12.2.1.4.0
Coherence
Version 3.7.1.0
Oracle
Commerce Platform
From 11.3.0 to 11.3.2
Commerce Platform
Version 11.0.0
Commerce Platform
Version 11.1.0
Commerce Platform
Version 11.2.0
Communications Diameter Signaling Router
From 8.0.0 to 8.2.2
Healthcare Data Repository
Version 7.0.1
Oracle
Rapid Planning
Version 12.1
Rapid Planning
Version 12.2
Oracle
Retail Assortment Planning
Version 15.0
Retail Assortment Planning
Version 16.0
Oracle
Utilities Framework
From 4.3.0.1.0 to 4.3.0.6.0
Utilities Framework
Version 4.2.0.2.0
Utilities Framework
Version 4.2.0.3.0
Utilities Framework
Version 4.4.0.0.0
Utilities Framework
Version 4.4.0.2.0
Oracle
Webcenter Portal
Version 12.2.1.3.0
Webcenter Portal
Version 12.2.1.4.0

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (17)

Source: secalert_us@oracle.com
ExploitThird Party AdvisoryVDB Entry
Source: secalert_us@oracle.com
ExploitThird Party AdvisoryVDB Entry
Source: secalert_us@oracle.com
ExploitThird Party AdvisoryVDB Entry
Source: secalert_us@oracle.com
Vendor Advisory
Source: secalert_us@oracle.com
Vendor Advisory
Source: secalert_us@oracle.com
Vendor Advisory
Source: secalert_us@oracle.com
PatchVendor Advisory
Source: secalert_us@oracle.com
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.