CVE-2020-2557: Medium severity Oracle Demantra Demand Management vulnerability

Published Jan 15, 2020

Updated

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Security). Supported versions that are affected are 12.2.4, 12.2.4.1, 12.2.5 and 12.2.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demantra Demand Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Demantra Demand Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Demantra Demand Management accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).

Affected Software

4 affected components

Oracle Demantra Demand Management=12.2.4

Oracle Demantra Demand Management=12.2.4.1

Oracle Demantra Demand Management=12.2.5

Oracle Demantra Demand Management=12.2.5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade oracle/demantra-demand-management (Oracle Supply Chain) / Security to a version that resolves this vulnerability.
Fixed in 12.2.4.1
Upgrade
Upgrade oracle/demantra-demand-management (Oracle Supply Chain) / Security to a version that resolves this vulnerability.
Fixed in 12.2.5.1
Compensating control
Restrict network access to Oracle Demantra Demand Management over HTTP so that unauthenticated attackers cannot reach it via HTTP (e.g., block HTTP at the network perimeter/firewall).

Event History

Jan 15, 2020

CVE Published

via MITRE·04:34 PM

Data Sourced

via MITRE·04:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-2557?

The severity of CVE-2020-2557 is medium with a severity value of 4.7.

Which software versions are affected by CVE-2020-2557?

The Oracle Demantra Demand Management versions 12.2.4, 12.2.4.1, 12.2.5, and 12.2.5.1 are affected by CVE-2020-2557.

How can an attacker exploit CVE-2020-2557?

An unauthenticated attacker with network access via HTTP can easily exploit CVE-2020-2557.

What is the component affected by CVE-2020-2557?

The Oracle Demantra Demand Management product of Oracle Supply Chain is affected by CVE-2020-2557.

Where can I find more information about CVE-2020-2557?

You can find more information about CVE-2020-2557 on the Oracle Security Alerts page.