CVE-2020-14824: Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure)

High severity · published Oct 21, 2020

CVE-2020-14824

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure)

8.6

CVSS

1.8%

EPSS

On KEV

Description

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that are affected are 8.0.6-8.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. While the vulnerability is in Oracle Financial Services Analytical Applications Infrastructure, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 8.6 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)1.8% · higher than 78% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Financial Services Analytical Applications Infrastructure · Oracle

8.0.6.0.0 through 8.1.0.0.0 · source: NVD

Affected product

Financial Services Analytical Applications Infrastructure

Oracle

All Financial Services Analytical Applications Infrastructure CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-14824

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-14824

Vendor Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

More from Financial Services Analytical Applications Infrastructure

9.8

CVE-2022-22965

Spring Framework JDK 9+ Remote Code Execution Vulnerability

9.8

CVE-2022-22963

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

8.1

CVE-2017-12617

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g

10.0

CVE-2018-14721

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class…

9.8

CVE-2025-53037

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)