Improper input validation in Oracle Communications Cloud Native Core Network Slice Selection Function - CVE-2020-29582

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU55164

Improper input validation in Oracle Communications Cloud Native Core Network Slice Selection Function - CVE-2020-29582

Published: July 21, 2021


Vulnerability identifier: #VU55164
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-29582
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Signaling (Calico) component in Oracle Communications Cloud Native Core Network Slice Selection Function. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


Affected software

Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Policy
IBM Cloud Transformation Advisor
IBM Business Automation Manager Open Editions
webMethods Integration Server
webMethods BPM
Oracle Communications User Data Repository
IBM Planning Analytics Workspace
watsonx.data
Event Streams

How to mitigate CVE-2020-29582

Install updates from vendor's website.

IBM Cloud Transformation Advisor - update to 3.2.0
IBM Business Automation Manager Open Editions - update to 8.0.8
webMethods BPM - update to 11.1 Fix 1
watsonx.data - update to 2.0.3
IBM Planning Analytics Workspace - update to 2.0.83
Event Streams - update to 11.4.0

External References

Related Security Bulletins