Oracle Multiple Products Remote Code Execution Vulnerability

KRITISCH 9.8EXPLOITED (CISA KEV)CVE-2020-2555 · Published 15/01/2020 · updated 17/06/2026

Oracle Multiple Products Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Kurz gesagt

CVE-2020-2555 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in access manager (oracle), coherence (oracle), commerce platform (oracle).
Wird aktiv ausgenutzt: CISA hat sie am 03/11/2021 in den KEV-Katalog aufgenommen.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 97.1%, höher als bei 99.9% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
access manager oracle	`= 11.1.2.3.0`	No fix yet
coherence oracle	`= 12.1.3.0.0= 12.2.1.3.0= 12.2.1.4.0= 3.7.1.0`	No fix yet
commerce platform oracle	`= 11.0.0= 11.1.0= 11.2.0≥ 11.3.0, ≤ 11.3.2`	No fix yet
communications diameter signaling router oracle	`≥ 8.0.0, ≤ 8.2.2`	No fix yet
healthcare data repository oracle	`= 7.0.1`	No fix yet
rapid planning oracle	`= 12.1= 12.2`	No fix yet
retail assortment planning oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

References

packetstormsecurity.com/files/157054/Oracle-Coherence-Fusion-Middleware-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/157207/Oracle-WebLogic-Server-12.2.1.4.0-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/157795/WebLogic-Server-Deserialization-Remote-Code-Execution.html · Exploit
oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
oracle.com/security-alerts/cpujan2021.html · Vendor Advisory
oracle.com/security-alerts/cpujul2020.html · Vendor Advisory
oracle.com/security-alerts/cpujul2021.html · Patch
oracle.com/security-alerts/cpuoct2020.html · Patch
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-2555

Weitere Schwachstellen in access manager

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Kurz gesagt

CVE-2020-2555 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in access manager (oracle), coherence (oracle), commerce platform (oracle).

Wird aktiv ausgenutzt: CISA hat sie am 03/11/2021 in den KEV-Katalog aufgenommen.

Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 97.1%, höher als bei 99.9% aller Schwachstellen.

Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package

Affected versions

Patched versions

access manager

oracle

= 11.1.2.3.0

No fix yet

coherence

oracle

= 12.1.3.0.0= 12.2.1.3.0= 12.2.1.4.0= 3.7.1.0

No fix yet

commerce platform

oracle

= 11.0.0= 11.1.0= 11.2.0≥ 11.3.0, ≤ 11.3.2

No fix yet

communications diameter signaling router

oracle

≥ 8.0.0, ≤ 8.2.2

No fix yet

healthcare data repository

oracle

= 7.0.1

No fix yet

rapid planning

oracle

= 12.1= 12.2

No fix yet

retail assortment planning

oracle

Description

Weitere Schwachstellen in access manager

Alle anzeigen →