Improper input validation in Oracle Retail Order Broker - CVE-2020-5398

Vulnerability identifier: #VU27264

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green

CVE-ID: CVE-2020-5398

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Affected software:
Oracle Retail Order Broker
Oracle Healthcare Master Person Index
Dell Support Assist Enterprise
Oracle Insurance Rules Palette
Oracle FLEXCUBE Private Banking
Oracle Application Testing Suite
Oracle Retail Returns Management
Oracle Retail Central Office
Oracle Retail Back Office
Oracle Communications Cloud Native Core Policy
MySQL Enterprise Monitor
Oracle Communications BRM - Elastic Charging Engine
Integrated Diameter Intelligence Hub (IDIH)
Oracle Financial Services Regulatory Reporting with AgileREPORTER
Oracle Communications Session Report Manager
Enterprise Manager Base Platform
Oracle Communications Session Route Manager
Oracle Communications Element Manager
Oracle Insurance Policy Administration
Oracle Retail Bulk Data Integration
Siebel Engineering - Installer & Deployment
Oracle WebLogic Server
Oracle Retail Point of Service

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the System Administration (Spring Framework) component in Oracle Retail Order Broker. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Install updates from vendor's website.

• https://www.oracle.com/security-alerts/cpuapr2020.html