LiveActive security incident?Get immediate response
CVE Record

CVE-2020-14740: Vulnerability in the SQL Developer Install component of Oracle Database Server.

Vulnerability in the SQL Developer Install component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows low privileged attacker having Client Computer User Account privilege with logon to the infrastructure where SQL Developer Install executes to compromise SQL Developer Install. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of SQL Developer Install accessible data. CVSS 3.1 Base Score 2.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N).

LowCVSS 2.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2020-14740 is a low-severity Oracle SQL Developer Install issue. An attacker needs a local account on the infrastructure where the installer runs and must convince another person to interact. Successful exploitation could expose a limited subset of data accessible to SQL Developer Install.

Executive priority

Treat this as routine patch management unless the affected installer is used on shared systems with many local users. The business risk is limited data exposure, not system takeover, based on the supplied CVSS and description.

Technical view

The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N, scoring 2.8. The issue affects supported versions 11.2.0.4, 12.1.0.2, 12.2.0.1, and 18c. Impact is confidentiality-only with no stated integrity or availability impact.

Likely exposure

Exposure is likely limited to environments running the affected SQL Developer Install component where low-privileged users can log on locally. The source does not indicate network exploitation or unauthenticated exposure.

Exploitation context

The source requires local access, low privileges, and human interaction by someone other than the attacker. CISA KEV status is false, and the provided sources do not report active exploitation.

Researcher notes

No CWE is listed in the provided data. Evidence is limited to the CVE description and Oracle CPU reference. Do not assume broader Oracle Database compromise; validate the specific SQL Developer Install component and affected versions only.

Mitigation direction

  • Review Oracle October 2020 Critical Patch Update guidance for the affected component.
  • Apply the relevant Oracle remediation for affected supported versions.
  • Restrict local logon access where SQL Developer Install executes.
  • Avoid running installer workflows from untrusted user-controlled locations or sessions.

Validation and detection

  • Inventory Oracle SQL Developer Install deployments and affected versions.
  • Confirm whether versions 11.2.0.4, 12.1.0.2, 12.2.0.1, or 18c are present.
  • Verify Oracle October 2020 CPU remediation status for each affected asset.
  • Review local account access on systems where SQL Developer Install executes.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-14740 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.8CVSS 3.1LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N1.31.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

2.8Low
CVSS 3.1 vector shape for CVE-2020-14740Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Oracle CorporationSQL Developer11.2.0.4, 12.1.0.2, 12.2.0.1, 18cListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.