Applications Framework
CVE-2020-2866
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Supported versions that are affected are 12.2.5-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
AnalysisAI
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Supported versions that are affected are 12.2.5-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Affected products include: Oracle Applications Framework.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Applications Framework
View allVulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Full takeover of the Oracle Applications Framework (Web Utilities component) is possible in Oracle E-Business Suite 12.2
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Home page). Rated crit
Account takeover in Oracle Applications Framework (Search Bean component) affects Oracle E-Business Suite versions 12.2.
Account or application takeover of Oracle Applications Framework - the presentation-layer component of Oracle E-Business
Privilege-abusing account takeover in Oracle Applications Framework (Web Utilities component) of Oracle E-Business Suite
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popups). Rated high se
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Rated hi
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Attachments / Fil
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: None). Rated high
Data compromise in Oracle Applications Framework (12.2.3 through 12.2.15), a core component of Oracle E-Business Suite,
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upl
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today