Improper input validation in Oracle Enterprise Repository - CVE-2020-11994
Published: January 20, 2021
Vulnerability identifier: #VU49792
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-11994
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Security Subsystem (Apache Camel) component in Oracle Enterprise Repository. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
Affected software
Oracle Enterprise Repository
Enterprise Manager Base Platform
Fuse
Enterprise Manager Base Platform
Fuse
How to mitigate CVE-2020-11994
Install updates from vendor's website.
Fuse - update to 6.3.0