CVE-2020-14876: Oracle E-Business Suite ozfVendorLov SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of Oracle E-Business Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within ozfVendorLov.jsp. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Other sources
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Trade Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-14876.
What is the severity of CVE-2020-14876?
The severity of CVE-2020-14876 is critical, with a severity score of 9.1.
Which Oracle E-Business Suite versions are affected by CVE-2020-14876?
The affected versions of Oracle E-Business Suite are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10.
What is the affected component of Oracle E-Business Suite?
The affected component is User Interface of Oracle Trade Management in Oracle E-Business Suite.
How can an attacker exploit CVE-2020-14876?
An unauthenticated attacker with network access via HTTP can exploit the vulnerability to compromise Oracle E-Business Suite and disclose sensitive information.