CVE-2020-2978: Medium severity ibm security identity manager vulnerability
An unspecified vulnerability in Oracle Database - Enterprise Edition related to the DBA role account component could allow an authenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
Other sources
Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA role account privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition. While the vulnerability is in Oracle Database - Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database - Enterprise Edition accessible data. CVSS 3.1 Base Score 4.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-2978?
CVE-2020-2978 is an unspecified vulnerability in Oracle Database - Enterprise Edition related to the DBA role account.
Which versions of Oracle Database - Enterprise Edition are affected by CVE-2020-2978?
CVE-2020-2978 affects Oracle Database - Enterprise Edition versions 12.1.0.2, 12.2.0.1, 18c, and 19c.
What is the severity of CVE-2020-2978?
The severity of CVE-2020-2978 is medium with a CVSS score of 4.1.
How can the CVE-2020-2978 vulnerability be exploited?
The vulnerability can be easily exploited by a high privileged attacker with the DBA role account privilege and network access via Oracle Database.
Are there any references for CVE-2020-2978?
Yes, you can find references for CVE-2020-2978 [here](http://packetstormsecurity.com/files/172183/Oracle-RMAN-Missing-Auditing.html), [here](https://databasesecurityninja.wordpress.com/2020/12/01/cve-2020-2978-rman-audit-table-point-in-time-recovery-not-logged/), and [here](https://www.oracle.com/security-alerts/cpujul2020.html).