CVE-2020-14561 — Improper Access Control

Vendor	Product	Version range	Fixed in
oracle	food_and_beverage_applications	—	—
oracle_corporation	hospitality_reporting_and_analytics	—	—

Red Hat

solr: replication handler allows a read-write operations to any location the solr user can access

vendor_redhat·2020-08-17·CVSS 8.8

CVE-2020-13941 [HIGH] CWE-284 solr: replication handler allows a read-write operations to any location the solr user can access solr: replication handler allows a read-write operations to any location the solr user can access Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access. A flaw was found in Solr. The Replication handler allows commands backup, restore, and delete backup that take non-validated allocation parameters which may result in the exfiltration of sensitive data such as OS user hashes (NTLM/LMhashes). The highest threat from this vulnerabilit

Oracle

Oracle Oracle Food and Beverage Applications Risk Matrix: Installation — CVE-2020-14561

vendor_oracle·2020-07-15·CVSS 7.3

CVE-2020-14561 [HIGH] Oracle Oracle Food and Beverage Applications Risk Matrix: Installation — CVE-2020-14561 Oracle Oracle Food and Beverage Applications Risk Matrix: Installation vulnerability CVE: CVE-2020-14561 CVSS: 7.3 Protocol: None Remote exploit: No Affected versions: Local Advisory: cpujul2020 (JUL 2020)

GHSA

GHSA-6hf9-2c4c-m4j4: Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Installation)

ghsa_unreviewed·2022-05-24

CVE-2020-14561 [MEDIUM] GHSA-6hf9-2c4c-m4j4: Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Installation) Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Installation). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality Reporting and Analytics executes to compromise Oracle Hospitality Reporting and Analytics. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Reporting and Analytics. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

GHSA

Improper Input Validation in Apache Solr

ghsa·2022-02-10

CVE-2020-13941 [MEDIUM] CWE-20 Improper Input Validation in Apache Solr Improper Input Validation in Apache Solr Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.

CVE-2020-14561: Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Installation). The supported…

Affected

CVSS provenance