CVE-2020-14740

low-risk
Published 2020-10-21

Vulnerability in the SQL Developer Install component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows low privileged attacker having Client Computer User Account privilege with logon to the infrastructure where SQL Developer Install executes to compromise SQL Developer Install. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of SQL Developer Install accessible data. CVSS 3.1 Base Score 2.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N).

Do I need to act?

-
0.09% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.8/10 Low
LOCAL / LOW complexity

Affected Products (4)

Sql Developer
Sql Developer
Sql Developer
Sql Developer

Affected Vendors

Oracle

References (2)

Patch https://www.oracle.com/security-alerts/cpuoct2020.html
Patch https://www.oracle.com/security-alerts/cpuoct2020.html
21
/ 100
low-risk
Severity 11/34 · Low
Exploitability 0/34 · Minimal
Exposure 10/34 · Low