CVE-2020-2673: High severity Oracle Application Testing Suite vulnerability
Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Oracle Flow Builder). Supported versions that are affected are 12.5.0.3, 13.1.0.1, 13.2.0.1 and 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access over HTTP to the Oracle Application Testing Suite (Oracle Enterprise Manager component: Oracle Flow Builder) so unauthenticated attackers cannot reach it via HTTP.
Event History
Frequently Asked Questions
What is CVE-2020-2673?
CVE-2020-2673 is a vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager.
What is the severity of CVE-2020-2673?
CVE-2020-2673 has a severity rating of 7.5 out of 10.
Which versions of Oracle Application Testing Suite are affected by CVE-2020-2673?
Oracle Application Testing Suite versions 12.5.0.3, 13.1.0.1, 13.2.0.1, and 13.3.0.1 are affected by CVE-2020-2673.
Is CVE-2020-2673 easily exploitable?
Yes, CVE-2020-2673 is an easily exploitable vulnerability.
Where can I find more information about CVE-2020-2673?
More information about CVE-2020-2673 can be found on the Oracle Security Alerts page.