CVE-2020-14874

Vulnerability in the Oracle Cloud Infrastructure Identity and Access Management product of Oracle Cloud Services. Easily exploitable vulnerability allows high privileged attacker with network access to compromise Oracle Cloud Infrastructure Identity and Access Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Cloud Infrastructure Identity and Access Management accessible data as well as unauthorized read access to a subset of Oracle Cloud Infrastructure Identity and Access Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Cloud Infrastructure Identity and Access Management.

CVSS v3 4.7 MEDIUM
CVSS v2.0 6.5 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.oracle.com/security-alerts/oracle-cves-outside-other-oracle-public-documents.html
https://www.oracle.com/security-alerts/oracle-cves-outside-other-oracle-public-documents.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:cloud_infrastructure_identity_and_access_management:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:04

Type	Values Removed	Values Added
References	~~() https://www.oracle.com/security-alerts/oracle-cves-outside-other-oracle-public-documents.html -~~	() https://www.oracle.com/security-alerts/oracle-cves-outside-other-oracle-public-documents.html -

Information

Published : 2020-12-22 22:15

Updated : 2024-11-21 05:04

NVD link : CVE-2020-14874

Mitre link : CVE-2020-14874

CVE.ORG link : CVE-2020-14874

JSON object : View

Products Affected

oracle

cloud_infrastructure_identity_and_access_management

CWE

NVD-CWE-noinfo

{"id": "CVE-2020-14874", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.2}]}, "published": "2020-12-22T22:15:12.880", "references": [{"url": "https://www.oracle.com/security-alerts/oracle-cves-outside-other-oracle-public-documents.html", "source": "secalert_us@oracle.com"}, {"url": "https://www.oracle.com/security-alerts/oracle-cves-outside-other-oracle-public-documents.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Cloud Infrastructure Identity and Access Management product of Oracle Cloud Services. Easily exploitable vulnerability allows high privileged attacker with network access to compromise Oracle Cloud Infrastructure Identity and Access Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Cloud Infrastructure Identity and Access Management accessible data as well as unauthorized read access to a subset of Oracle Cloud Infrastructure Identity and Access Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Cloud Infrastructure Identity and Access Management."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Cloud Infrastructure Identity and Access Management de Oracle Cloud Services. La vulnerabilidad f\u00e1cilmente explotable permite a un atacante con altos privilegios y acceso a la red comprometer Oracle Cloud Infrastructure Identity and Access Management. Los ataques exitosos de esta vulnerabilidad pueden dar lugar a la actualizaci\u00f3n no autorizada, insertar o eliminar el acceso a algunos de los datos accesibles de Oracle Cloud Infrastructure Identity and Access Management, as\u00ed como el acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle Cloud Infrastructure Identity and Access Management y la capacidad no autorizada de causar una denegaci\u00f3n parcial de servicio (DOS parcial) de Oracle Cloud Infrastructure Identity and Access Management"}], "lastModified": "2024-11-21T05:04:22.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:cloud_infrastructure_identity_and_access_management:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF863E4A-BE32-4C39-AEA9-4F76898BB64C"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}