CVE-2020-2978

Reference Links

• http://packetstormsecurity.com/files/172183/Oracle-RMAN-Missing-Auditing.html
• https://databasesecurityninja.wordpress.com/2020/12/01/cve-2020-2978-rman-audit-table-point-in-time-recovery-not-logged/
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/185213
• https://www.ibm.com/support/pages/node/6454587 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6454587

Frequently Asked Questions

• What is CVE-2020-2978?

  CVE-2020-2978 is an unspecified vulnerability in Oracle Database - Enterprise Edition related to the DBA role account.

• Which versions of Oracle Database - Enterprise Edition are affected by CVE-2020-2978?

  CVE-2020-2978 affects Oracle Database - Enterprise Edition versions 12.1.0.2, 12.2.0.1, 18c, and 19c.

• What is the severity of CVE-2020-2978?

  The severity of CVE-2020-2978 is medium with a CVSS score of 4.1.

• How can the CVE-2020-2978 vulnerability be exploited?

  The vulnerability can be easily exploited by a high privileged attacker with the DBA role account privilege and network access via Oracle Database.

• Are there any references for CVE-2020-2978?

  Yes, you can find references for CVE-2020-2978 [here](http://packetstormsecurity.com/files/172183/Oracle-RMAN-Missing-Auditing.html), [here](https://databasesecurityninja.wordpress.com/2020/12/01/cve-2020-2978-rman-audit-table-point-in-time-recovery-not-logged/), and [here](https://www.oracle.com/security-alerts/cpujul2020.html).