Vulnerabilities > CVE-2020-2952 - Unspecified vulnerability in Oracle Http Server 11.1.1.9.0
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
NONE Summary
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HTTP Server accessible data as well as unauthorized read access to a subset of Oracle HTTP Server accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Nessus
| NASL family | Web Servers |
| NASL id | ORACLE_HTTP_SERVER_CPU_APR_2020.NASL |
| description | The version of Oracle HTTP Server installed on the remote host is affected by the following vulnerabilities as referenced in the April 2020 CPU advisory: - An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Oracle HTTP Server |
| last seen | 2020-05-08 |
| modified | 2020-04-16 |
| plugin id | 135677 |
| published | 2020-04-16 |
| reporter | This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/135677 |
| title | Oracle Fusion Middleware Oracle HTTP Server (Apr 2020 CPU) |