CVE-2020-2737: Medium severity oracle database vulnerability

Published Apr 15, 2020

Updated

Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Core RDBMS. CVSS 3.0 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).

Affected Software

5 affected components

Oracle Database Server=11.2.0.4

Oracle Database Server=12.1.0.2

Oracle Database Server=12.2.0.1

Oracle Database Server=18c

Oracle Database Server=19c

Event History

Apr 15, 2020

CVE Published

via MITRE·01:29 PM

Data Sourced

via MITRE·01:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-2737?

The severity of CVE-2020-2737 is medium.

Which versions of Oracle Database Server are affected by CVE-2020-2737?

Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c are affected by CVE-2020-2737.

What privileges does an attacker need to exploit CVE-2020-2737?

An attacker needs Create Session and Execute Catalog Role privileges with network access to exploit CVE-2020-2737.

Is CVE-2020-2737 difficult to exploit?

Yes, CVE-2020-2737 is difficult to exploit.

Where can I find more information about CVE-2020-2737?

You can find more information about CVE-2020-2737 [here](https://www.oracle.com/security-alerts/cpuapr2020.html).