High severity · published Jul 15, 2020
CVE-2020-14630
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications Applications (component: File Upload)
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications Applications (component: File Upload). Supported versions that are affected are 8.1.0, 8.2.0 and 8.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Enterprise Session Border Controller. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Session Border Controller, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Session Border Controller as well as unauthorized update, insert or delete access to some of Oracle Enterprise Session Border Controller accessible data and unauthorized read access to a subset of Oracle Enterprise Session Border Controller accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Enterprise Session Border Controller · Oracle
8.1.0; 8.2.0; 8.3.0 · source: NVD
Affected product
ES
Enterprise Session Border Controller
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14630
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14630
Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
More from Enterprise Session Border Controller
9.8
CVE-2021-3711
SM2 Decryption Buffer Overflow
7.7
CVE-2022-21382
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI)
7.7
CVE-2021-23017
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting…
7.4
CVE-2021-3712
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length
6.4
CVE-2022-21381
Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: WebUI)