CVE-2020-2931
published 2020-04-15CVE-2020-2931: Vulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Web Applications - InfoCenter). Supported versions that are affected are…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.71%
84.4th percentile
Vulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Web Applications - InfoCenter). Supported versions that are affected are 8.6.0-8.6.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle Knowledge. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | knowledge | 8.6.0 – 8.6.3 | — |
| oracle_corporation | knowledge | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability targets Oracle Knowledge Web Applications - InfoCenter component, accessible over HTTP without authentication — monitor for unauthenticated HTTP requests to Oracle Knowledge InfoCenter endpoints ↗
- →Affected versions are Oracle Knowledge 8.6.0 through 8.6.3 — fingerprint version banners or response headers to identify exposed instances ↗
- ·Attack vector is Network with no privileges required and no user interaction — perimeter controls alone are insufficient; patch or isolate affected Oracle Knowledge 8.6.0–8.6.3 instances immediately ↗
- ·Full system takeover (Confidentiality, Integrity, and Availability all HIGH) is possible via unauthenticated HTTP — treat any exposed instance as critically at risk ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_oracle9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Knowledge Risk Matrix: Web Applications - InfoCenter — CVE-2020-2931
vendor_oracle·2020-04-15·CVSS 9.8
CVE-2020-2931 [CRITICAL] Oracle Oracle Knowledge Risk Matrix: Web Applications - InfoCenter — CVE-2020-2931
Oracle Oracle Knowledge Risk Matrix: Web Applications - InfoCenter vulnerability
CVE: CVE-2020-2931
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2020 (APR 2020)
GHSA
GHSA-4h43-v6pq-58m2: Vulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Web Applications - InfoCenter)
ghsa_unreviewed·2022-05-24
CVE-2020-2931 [HIGH] GHSA-4h43-v6pq-58m2: Vulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Web Applications - InfoCenter)
Vulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Web Applications - InfoCenter). Supported versions that are affected are 8.6.0-8.6.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle Knowledge. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-04-15
Published