Oracle Multiple Products Remote Code Execution Vulnerability

CRÍTICO 9.8EXPLOITED (CISA KEV)CVE-2020-2555 · Published 15/01/2020 · updated 17/06/2026

Oracle Multiple Products Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Em resumo

CVE-2020-2555 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta access manager (oracle), coherence (oracle), commerce platform (oracle).
Explorada ativamente: a CISA a adicionou ao catálogo KEV em 03/11/2021.
Chance de exploração nos próximos 30 dias (EPSS): 97.1%, maior que 99.9% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
access manager oracle	`= 11.1.2.3.0`	No fix yet
coherence oracle	`= 12.1.3.0.0= 12.2.1.3.0= 12.2.1.4.0= 3.7.1.0`	No fix yet
commerce platform oracle	`= 11.0.0= 11.1.0= 11.2.0≥ 11.3.0, ≤ 11.3.2`	No fix yet
communications diameter signaling router oracle	`≥ 8.0.0, ≤ 8.2.2`	No fix yet
healthcare data repository oracle	`= 7.0.1`	No fix yet
rapid planning oracle	`= 12.1= 12.2`	No fix yet
retail assortment planning oracle

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

References

packetstormsecurity.com/files/157054/Oracle-Coherence-Fusion-Middleware-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/157207/Oracle-WebLogic-Server-12.2.1.4.0-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/157795/WebLogic-Server-Deserialization-Remote-Code-Execution.html · Exploit
oracle.com/security-alerts/cpujan2020.html · Vendor Advisory
oracle.com/security-alerts/cpujan2021.html · Vendor Advisory
oracle.com/security-alerts/cpujul2020.html · Vendor Advisory
oracle.com/security-alerts/cpujul2021.html · Patch
oracle.com/security-alerts/cpuoct2020.html · Patch
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-2555

Mais vulnerabilidades de access manager

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Em resumo

CVE-2020-2555 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta access manager (oracle), coherence (oracle), commerce platform (oracle).

Explorada ativamente: a CISA a adicionou ao catálogo KEV em 03/11/2021.

Chance de exploração nos próximos 30 dias (EPSS): 97.1%, maior que 99.9% das vulnerabilidades.

Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package

Affected versions

Patched versions

access manager

oracle

= 11.1.2.3.0

No fix yet

coherence

oracle

= 12.1.3.0.0= 12.2.1.3.0= 12.2.1.4.0= 3.7.1.0

No fix yet

commerce platform

oracle

= 11.0.0= 11.1.0= 11.2.0≥ 11.3.0, ≤ 11.3.2

No fix yet

communications diameter signaling router

oracle

≥ 8.0.0, ≤ 8.2.2

No fix yet

healthcare data repository

oracle

= 7.0.1

No fix yet

rapid planning

oracle

= 12.1= 12.2

No fix yet

retail assortment planning

oracle

Description

Mais vulnerabilidades de access manager

Ver tudo →