CVE-2020-2735
First published: Wed Apr 15 2020(Updated: )
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java VM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java VM. CVSS 3.0 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Database Server | =11.2.0.4 | |
| Oracle Database Server | =12.1.0.2 | |
| Oracle Database Server | =12.2.0.1 | |
| Oracle Database Server | =18c | |
| Oracle Database Server | =19c |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-2735?
CVE-2020-2735 is a vulnerability in the Java VM component of Oracle Database Server, affecting versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c.
What is the severity of CVE-2020-2735?
CVE-2020-2735 has a severity rating of high (8).
How can CVE-2020-2735 be exploited?
CVE-2020-2735 can be exploited by a low privileged attacker with Create Session privilege and network access via Oracle Net.
Which versions of Oracle Database Server are affected by CVE-2020-2735?
CVE-2020-2735 affects Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c.
Where can I find more information about CVE-2020-2735?
More information about CVE-2020-2735 can be found at the Oracle Security Alerts page: https://www.oracle.com/security-alerts/cpuapr2020.html
- collector/nvd-index
- agent/author
- agent/severity
- agent/references
- agent/type
- agent/event
- agent/description
- agent/tags
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/oracle
- canonical/oracle database server
- version/oracle database server/11.2.0.4
- version/oracle database server/12.1.0.2
- version/oracle database server/12.2.0.1
- version/oracle database server/18c
- version/oracle database server/19c