CVE-2020-2545: Medium severity Oracle HTTP Server vulnerability
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because the vulnerability is network-accessible via HTTPS and can cause partial denial of service of Oracle HTTP Server, restrict HTTPS access to the Oracle HTTP Server (including the OSSL Module) to only trusted clients (e.g., via firewall/ACL).
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2545?
The severity of CVE-2020-2545 is medium with a CVSS score of 5.3.
What is the affected software for CVE-2020-2545?
The affected software for CVE-2020-2545 is Oracle HTTP Server versions 11.1.1.9.0, 12.1.3.0.0, and 12.2.1.3.0.
Is CVE-2020-2545 easily exploitable?
Yes, CVE-2020-2545 is an easily exploitable vulnerability.
How can an attacker exploit CVE-2020-2545?
An unauthenticated attacker with network access via HTTPS can exploit CVE-2020-2545 to compromise Oracle HTTP Server.
Where can I find more information about CVE-2020-2545?
You can find more information about CVE-2020-2545 on the Oracle Security Alerts page: https://www.oracle.com/security-alerts/cpujan2020.html