CVE-2020-14876

published 2020-10-21

CVE-2020-14876: Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1 -…

Priority P2 63 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Trade Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	mysql-8.0	< mysql-8.0 8.0.22-1 (sid)	mysql-8.0 8.0.22-1 (sid)
oracle	trade_management	12.1.1 – 12.1.3	—
oracle	trade_management	12.2.3 – 12.2.10	—
oracle_corporation	trade_management	—	—
oracle_corporation	trade_management	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerability is exploitable over HTTP by an unauthenticated, network-adjacent attacker with no user interaction required — monitor for anomalous unauthenticated HTTP requests targeting Oracle Trade Management User Interface endpoints. ↗
• → Affected versions are Oracle E-Business Suite Trade Management 12.1.1–12.1.3 and 12.2.3–12.2.10; presence of these versions in the environment indicates exposure. ↗
• → Successful exploitation results in unauthorized data creation, deletion, modification, or read access — alert on unexpected data modification or exfiltration events from Oracle Trade Management. ↗

• · The vulnerability is scoped to the Oracle Trade Management User Interface component only; other E-Business Suite components are not directly affected by this CVE. ↗
• · No Authentication or user interaction is required, meaning network-level controls (e.g., firewall rules restricting HTTP access to Oracle EBS Trade Management) are the primary compensating control prior to patching. ↗
• · The CVSS vector indicates no impact on Availability (A:N), so denial-of-service is not a concern; focus detection on Confidentiality and Integrity impacts. ↗

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvd v2.0 8.5 HIGH AV:N/AC:L/Au:N/C:C/I:P/A:N

osv 9.1 CRITICAL

vendor_debian 9.1 CRITICAL

vendor_oracle 9.1 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.