CVE-2020-2734 — Corporation Oracle Database vulnerability

4 documents4 sources

Severity

2.4LOWNVD

EPSS

0.3%

top 45.80%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Oracle Corporation Oracle Database Oracle Database Server

Timeline

PublishedApr 15

Latest updateMay 24

Description

Vulnerability in the RDBMS/Optimizer component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Execute on DBMS_SQLTUNE privilege with network access via Oracle Net to compromise RDBMS/Optimizer. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of R…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:NExploitability: 0.9 | Impact: 1.4

Affected Packages2 packages

▶NVDoracle/database_server4 versions+3

▶CVEListV5oracle_corporation/oracle_database4 versions+3

🔴Vulnerability Details

GHSA

GHSA-jjf4-23g8-gc3w: Vulnerability in the RDBMS/Optimizer component of Oracle Database Server↗2022-05-24

▶

CVEList

CVE-2020-2734: Vulnerability in the RDBMS/Optimizer component of Oracle Database Server↗2020-04-15

▶

📋Vendor Advisories

Oracle

Oracle Oracle Database Server Risk Matrix: RDBMS/Optimizer — CVE-2020-2734↗2020-04-15

▶