Exploited vulnerability

CVE-2020-2555

TLP:CLEAR

Oracle Multiple Products Remote Code Execution Vulnerability

Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).

Facts

Vendor: Oracle
Product: Multiple Products
CVSS: 9.8
EPSS (probability of exploitation within 30 days): 97.1 %
On CISA's Known Exploited Vulnerabilities list since: 3 November 2021
First known exploitation: 3 November 2021
CISA's deadline for US federal agencies: 3 May 2022
Weakness: CWE-502
First seen by Risk Letters: 3 November 2021

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD