Medium severity · published Oct 21, 2020
CVE-2020-14745
Vulnerability in the Oracle REST Data Services product of Oracle REST Data Services (component: General)
4.3
CVSS
1%
EPSS
No
On KEV
Description
Vulnerability in the Oracle REST Data Services product of Oracle REST Data Services (component: General). Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c; Standalone ORDS: prior to 20.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RD
Rest Data Services · Oracle
before 20.2.1; 11.2.0.4; 12.1.0.2; 12.2.0.1; 18c; 19c · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14745
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14745
Patch
https://www.oracle.com/security-alerts/cpuoct2020.html
More from Rest Data Services
6.1
CVE-2020-11023
Potential XSS vulnerability in jQuery
10.0
CVE-2026-46840
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service)
9.9
CVE-2026-46839
Vulnerability in Oracle REST Data Services (component: Core)
9.9
CVE-2026-46775
Vulnerability in Oracle REST Data Services (component: Core)
9.8
CVE-2017-7658
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths…