Medium severity · published Jul 15, 2020
CVE-2020-14574
Vulnerability in the Oracle Communications Interactive Session Recorder product of Oracle Communications Applications (component: FACE)
4.7
CVSS
0.3%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Communications Interactive Session Recorder product of Oracle Communications Applications (component: FACE). Supported versions that are affected are 6.1-6.4. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications Interactive Session Recorder executes to compromise Oracle Communications Interactive Session Recorder. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Interactive Session Recorder accessible data as well as unauthorized update, insert or delete access to some of Oracle Communications Interactive Session Recorder accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N).
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Communications Interactive Session Recorder · Oracle
6.1 through 6.4 · source: NVD
Affected product
CI
Communications Interactive Session Recorder
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14574
Patch
https://www.oracle.com/security-alerts/cpujul2020.html
More from Communications Interactive Session Recorder
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
6.1
CVE-2020-11023
Potential XSS vulnerability in jQuery
9.8
CVE-2017-5645
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…
8.8
CVE-2021-22112
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is…
8.3
CVE-2021-2461
Vulnerability in the Oracle Communications Interactive Session Recorder product of Oracle Communications (component: Provision API)