CVE-2020-2555
Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How to fix
Apply updates per vendor instructions.
CISA due date: May 3, 2022Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle access_manager | 11.1.2.3.0 | — |
| oracle coherence | 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle commerce_platform | 11.3.0 ≤ v ≤ 11.3.2, 11.0.0, 11.1.0, 11.2.0 | — |
| oracle communications_diameter_signaling_router | 8.0.0 ≤ v ≤ 8.2.2 | — |
| oracle healthcare_data_repository | 7.0.1 | — |
| oracle rapid_planning | 12.1, 12.2 | — |
| oracle retail_assortment_planning | 15.0, 16.0 | — |
| oracle utilities_framework | 4.3.0.1.0 ≤ v ≤ 4.3.0.6.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2.0 | — |
| oracle webcenter_portal | 12.2.1.3.0, 12.2.1.4.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.