CVE-2020-14598: Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobile Applications). Supported versions…

PriorityP258critical9.1CVSS 3.1

AVNACLPRNUINSUCHIHAN

EPSS

1.64%

73.4th percentile

Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobile Applications). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Gateway for Mobile Devices. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle CRM Gateway for Mobile Devices accessible data as well as unauthorized access to critical data or complete access to all Oracle CRM Gateway for Mobile Devices accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
oracle	customer_relationship_management_gateway_for_mobile_devices	12.1.1 – 12.1.3	—
oracle_corporation	crm_gateway_for_mobile_devices	—	—

Detection & IOCsextracted from sources · hover to see the quote

→The vulnerability is exploitable over HTTP without authentication (PR:N/UI:N), targeting Oracle CRM Gateway for Mobile Devices — monitor for unauthenticated HTTP requests to the 'Setup of Mobile Applications' component endpoints. ↗
→Focus detection on Oracle E-Business Suite versions 12.1.1 through 12.1.3 running CRM Gateway for Mobile Devices; these are the confirmed affected versions. ↗
→Successful exploitation results in unauthorized data creation, deletion, modification, or read access — alert on anomalous unauthenticated write/read activity against CRM Gateway for Mobile Devices data stores. ↗

·No authentication or user interaction is required, meaning network-perimeter controls (firewall rules restricting HTTP access to EBS CRM Gateway endpoints) are a critical compensating control until patching. ↗
·The vulnerability is scoped to the 'Setup of Mobile Applications' component within Oracle E-Business Suite; only instances with this component enabled and exposed over HTTP are at risk. ↗

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

vendor_oracle9.1CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.