CVE-2020-2969: Medium severity oracle database vulnerability

Published Jul 15, 2020

Updated

Vulnerability in the Data Pump component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows high privileged attacker having DBA role account privilege with network access via Oracle Net to compromise Data Pump. Successful attacks of this vulnerability can result in takeover of Data Pump. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

Affected Software

5 affected components

Oracle Database Server=11.2.0.4

Oracle Database Server=12.1.0.2

Oracle Database Server=12.2.0.1

Oracle Database Server=18c

Oracle Database Server=19c

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpujul2020.html

Event History

Jul 15, 2020

CVE Published

via MITRE·05:34 PM

Data Sourced

via MITRE·05:34 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-2969?

The severity of CVE-2020-2969 is medium.

Which versions of Oracle Database Server are affected by CVE-2020-2969?

The affected versions of Oracle Database Server are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, and 19c.

How can an attacker exploit CVE-2020-2969?

The vulnerability allows a high privileged attacker with DBA role account privilege and network access via Oracle Net to compromise the database server.

Is CVE-2020-2969 difficult to exploit?

Yes, CVE-2020-2969 is difficult to exploit.

Where can I find more information about CVE-2020-2969?

You can find more information about CVE-2020-2969 in Oracle's security alert: https://www.oracle.com/security-alerts/cpujul2020.html