CVE-2020-2915
Last modified
CVE-2020-2915 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching, CacheStore, Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. EPSS estimates a 1.96% chance of exploitation in the next 30 days.
Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching, CacheStore, Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Coherence | 3.7.1.0 |
| Oracle | Coherence | 12.1.3.0.0 |
| Oracle | Coherence | 12.2.1.3.0 |
| Oracle | Coherence | 12.2.1.4.0 |
References
- https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-2915?
How severe is CVE-2020-2915?
How do I fix CVE-2020-2915?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-29142A SQL injection vulnerability in interface/usergroup/usergro…7.2
- CVE-2020-29143A SQL injection vulnerability in interface/reports/non_repor…7.2
- CVE-2020-29144In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web…5.4
- CVE-2020-29145In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a w…5.4
- CVE-2020-29146A cross site scripting (XSS) vulnerability in index.php of W…6.1
- CVE-2020-29147A SQL injection vulnerability in wy_controlls/wy_side_visito…7.5
- CVE-2020-29156The WooCommerce plugin before 4.7.0 for WordPress allows rem…5.3
- CVE-2020-29157An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers t…7.8
- CVE-2020-29158An issue was discovered in Zammad before 3.5.1. An Agent wit…4.3
- CVE-2020-29159An issue was discovered in Zammad before 3.5.1. The default …4.9
- CVE-2020-29160An issue was discovered in Zammad before 3.5.1. A REST API c…7.5
- CVE-2020-29163PacsOne Server (PACS Server In One Box) below 7.1.1 is affec…8.8
Are you affected by CVE-2020-2915?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST