CVE-2020-2555

Oracle Multiple Products Remote Code Execution

9.8 CRITICALActively exploited (CISA KEV)Public exploitEPSS 97.1%

Published15 Jan 2020
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Oracle Access Manager11.1.2.3.0

Oracle Coherence12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 3.7.1.0

Oracle Commerce Platform≥ 11.3.0 ≤ 11.3.2 · 11.0.0 · 11.1.0 · 11.2.0

Oracle Communications Diameter Signaling Router≥ 8.0.0 ≤ 8.2.2

Oracle Healthcare Data Repository7.0.1

Oracle Rapid Planning12.1 · 12.2

Oracle Retail Assortment Planning15.0 · 16.0

Oracle Utilities Framework≥ 4.3.0.1.0 ≤ 4.3.0.6.0 · 4.2.0.2.0 · 4.2.0.3.0 · 4.4.0.0.0

Oracle Webcenter Portal12.2.1.3.0 · 12.2.1.4.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

http://packetstormsecurity.com/files/157054/Oracle-Coherence-Fusion-Middleware-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/157207/Oracle-WebLogic-Server-12.2.1.4.0-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/157795/WebLogic-Server-Deserialization-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2555US Government Resource
https://www.oracle.com/security-alerts/cpujan2020.htmlVendor Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlVendor Advisory
https://www.oracle.com/security-alerts/cpujul2020.htmlVendor Advisory
https://www.oracle.com/security-alerts/cpujul2021.htmlPatchVendor Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlPatchVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2020-2555 being actively exploited?

Yes. CVE-2020-2555 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2020-2555?

CVE-2020-2555 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 97.1% probability of exploitation.

Which products are affected by CVE-2020-2555?

Affected products include Oracle Access Manager, Oracle Coherence, Oracle Commerce Platform, Oracle Communications Diameter Signaling Router, Oracle Healthcare Data Repository, and 4 more.

How do I fix CVE-2020-2555?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-2555 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.