Improper input validation in Oracle Communications Session Report Manager - CVE-2020-5421

Vulnerability identifier: #VU49739

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N]

CVE-ID: CVE-2020-5421

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core (Spring Framework) component in Oracle Communications Session Report Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

Oracle Communications Session Report Manager
Oracle Communications Unified Inventory Management
Oracle Communications Design Studio
Oracle StorageTek ACSLS
Infrastructure Technology
Oracle Enterprise Data Quality
Primavera P6 Enterprise Project Portfolio Management
Autodesk Infraworks
watsonx.data
IBM Cloud Pak System
Oracle Endeca Information Discovery Integrator
Oracle Insurance Policy Administration
Oracle Healthcare Master Person Index
Dell Support Assist Enterprise
Oracle Financial Services Analytical Applications Infrastructure
Oracle Insurance Rules Palette
Oracle FLEXCUBE Private Banking
Oracle Retail Service Backbone
Oracle Retail Order Broker
Oracle Retail Xstore Point of Service
IBM Security Risk Manager
Storage Copy Data Management
IBM Tivoli Netcool Configuration Manager
MobileFirst Platform
IBM Engineering Requirements Management DOORS Next
MySQL Enterprise Monitor
Oracle Communications BRM - Elastic Charging Engine
Oracle WebLogic Server
Oracle Retail Predictive Application Server
Primavera Gateway
IBM Security Guardium
Oracle Fusion Middleware
Identity Manager
Oracle Retail Invoice Matching
Oracle Retail Financial Integration
Oracle Retail Customer Management and Segmentation Foundation
Oracle Retail Merchandising System
Oracle Retail Assortment Planning
Oracle Retail Integration Bus
Oracle Retail Customer Engagement
Oracle GoldenGate Application Adapters
IBM Cognos Controller

Install updates from vendor's website.

watsonx.data - update to 2.1
IBM Cloud Pak System - update to 2.3.3.4
Dell Support Assist Enterprise - update to 4.00.06.00
Primavera P6 Enterprise Project Portfolio Management - update to 16.2.20.1
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
IBM Security Risk Manager - update to 1.8.0.0
Storage Copy Data Management - update to 2.2.26.0
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.18
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202301121031
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7
IBM Cognos Controller - addressed in versions 10.4.1.0.15, 10.4.2.0.2

• Exploit #5051 - CVE-2020-5421 (Spring 安全漏洞 CVE-2020-5421复现 ) (January 21, 2021)

• https://www.oracle.com/security-alerts/cpujan2021.html

• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Improper input validation in Oracle Communications Session Report Manager
• Improper input validation in Primavera P6 Enterprise Project Portfolio Management
• Multiple vulnerabilities in Primavera Gateway
• Multiple vulnerabilities in Oracle GoldenGate Application Adapters
• Multiple vulnerabilities in Oracle Endeca Information Discovery Integrator
• Multiple vulnerabilities in Oracle WebLogic Server
• Improper input validation in Oracle Healthcare Master Person Index
• Multiple vulnerabilities in Hyperion Infrastructure Technology
• Improper input validation in Oracle Insurance Rules Palette
• Improper input validation in Oracle Insurance Policy Administration
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Improper input validation in Oracle Retail Assortment Planning
• Multiple vulnerabilities in Oracle Retail Service Backbone
• Multiple vulnerabilities in Oracle Retail Integration Bus
• Multiple vulnerabilities in Oracle Retail Financial Integration
• Multiple vulnerabilities in Oracle Retail Invoice Matching
• Multiple vulnerabilities in Oracle Retail Order Broker
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
• Multiple vulnerabilities in Oracle Fusion Middleware
• Multiple vulnerabilities in Oracle Retail Predictive Application Server
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Improper input validation in Oracle Enterprise Data Quality
• Improper input validation in Oracle Retail Customer Engagement
• Multiple vulnerabilities in Oracle Retail Merchandising System
• Multiple vulnerabilities in Oracle Retail Customer Management and Segmentation Foundation
• Multiple vulnerabilities in Oracle Communications Design Studio
• Multiple vulnerabilities in Oracle StorageTek ACSLS
• Multiple vulnerabilities in IBM Cloud Pak System
• Improper input validation in IBM Security Guardium
• Multiple vulnerabilities in IBM Security Risk Manager on CP4S
• Multiple vulnerabilities in Autodesk InfraWorks
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Improper input validation in Identity Manager
• Multiple vulnerabilities in IBM MobileFirst Platform Foundation
• Multiple vulnerabilities in Dell Support Assist Enterprise
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Storage Copy Data Management