CVE-2020-2882

published 2020-04-15

CVE-2020-2882: Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Supported versions that are affected are…

Priority P2 67 high 8.1 CVSS 3.1

AV N AC L PR L UI N S U C H I H A N

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Human Resources accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Affected

4 ranges

Vendor	Product	Version range	Fixed in
oracle	human_resources	12.1.1 – 12.1.3	—
oracle	human_resources	12.2.3 – 12.2.9	—
oracle_corporation	human_resources	—	—
oracle_corporation	human_resources	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerability affects Oracle E-Business Suite Human Resources component 'Hierarchy Diagrammers', exploitable over HTTP by a low-privileged authenticated network attacker — monitor for anomalous HTTP requests to Hierarchy Diagrammers endpoints from low-privileged accounts. ↗
• → Affected versions are Oracle E-Business Suite 12.1.1–12.1.3 and 12.2.3–12.2.9; prioritize detection and patching on hosts running these version ranges. ↗
• → Successful exploitation results in unauthorized data creation, deletion, modification, or read access to critical Oracle Human Resources data — alert on unexpected data modification or exfiltration events originating from HR module sessions. ↗

• · The vulnerability is only remotely exploitable by an authenticated (low-privileged) user — unauthenticated network access alone is insufficient for exploitation. ↗
• · No availability impact; the attack vector is Network with no required user interaction, meaning exploitation can be fully automated once credentials are obtained. ↗

CVSS provenance

nvd v3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

nvd v3.0 8.1 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

nvd v2.0 5.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:N

vendor_oracle 8.1 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.