CVE-2020-2734

published 2020-04-15

CVE-2020-2734: Vulnerability in the RDBMS/Optimizer component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily…

Priority P4 8 low 2.4 CVSS 3.1

AV N AC L PR H UI R S U C L I N A N

Vulnerability in the RDBMS/Optimizer component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Execute on DBMS_SQLTUNE privilege with network access via Oracle Net to compromise RDBMS/Optimizer. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS/Optimizer accessible data. CVSS 3.0 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).

Affected

8 ranges

Vendor	Product	Version range	Fixed in
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle	database_server	—	—
oracle_corporation	oracle_database	—	—
oracle_corporation	oracle_database	—	—
oracle_corporation	oracle_database	—	—
oracle_corporation	oracle_database	—	—

CVSS provenance

nvd v3.1 2.4 LOW CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

nvd v3.0 2.4 LOW CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:P/I:N/A:N

vendor_oracle 2.4 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.