Improper input validation in Oracle Retail Order Broker - CVE-2020-5398

Vulnerability identifier: #VU27264

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-5398

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the System Administration (Spring Framework) component in Oracle Retail Order Broker. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Oracle Retail Order Broker
Oracle Healthcare Master Person Index
Dell Support Assist Enterprise
Oracle Insurance Rules Palette
Oracle FLEXCUBE Private Banking
Oracle Application Testing Suite
Oracle Retail Returns Management
Oracle Retail Central Office
Oracle Retail Back Office
Oracle Communications Cloud Native Core Policy
MySQL Enterprise Monitor
Oracle Communications BRM - Elastic Charging Engine
Integrated Diameter Intelligence Hub (IDIH)
Oracle Financial Services Regulatory Reporting with AgileREPORTER
Oracle Communications Session Report Manager
Enterprise Manager Base Platform
Oracle Communications Session Route Manager
Oracle Communications Element Manager
Oracle Insurance Policy Administration
Oracle Retail Bulk Data Integration
Siebel Engineering - Installer & Deployment
Oracle WebLogic Server
Oracle Retail Point of Service

Install updates from vendor's website.

MySQL Enterprise Monitor - update to 8.0.21
Dell Support Assist Enterprise - update to 4.00.06.00

• https://www.oracle.com/security-alerts/cpuapr2020.html

• Multiple vulnerabilities in Oracle Retail Order Broker
• Multiple vulnerabilities in Oracle Communications Session Route Manager
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Improper input validation in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle Communications Element Manager
• Multiple vulnerabilities in Oracle WebLogic Server
• Improper input validation in Oracle Healthcare Master Person Index
• Multiple vulnerabilities in Oracle Insurance Rules Palette
• Multiple vulnerabilities in Oracle Insurance Policy Administration J2EE
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Multiple vulnerabilities in Integrated Diameter Intelligence Hub (IDIH)
• Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
• Multiple vulnerabilities in Oracle Financial Services Regulatory Reporting with AgileREPORTER
• Multiple vulnerabilities in Oracle Insurance Policy Administration J2EE
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Multiple vulnerabilities in Oracle Application Testing Suite
• Multiple vulnerabilities in Oracle Retail Bulk Data Integration
• Improper input validation in Siebel Engineering - Installer & Deployment
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Improper input validation in Oracle Retail Returns Management
• Improper input validation in Oracle Retail Point-of-Service
• Improper input validation in Oracle Retail Central Office
• Improper input validation in Oracle Retail Back Office
• Multiple vulnerabilities in Dell Support Assist Enterprise