Security readout for executives and security teams
Plain-English summary
This flaw affects Oracle Applications Manager within Oracle E-Business Suite. A remote unauthenticated attacker with HTTP network access could compromise the component and read or modify some accessible data. It is not described as full system takeover, but it affects confidentiality and integrity in a business application environment.
Executive priority
Treat this as a moderate-priority business application risk. Prioritize remediation for internet-facing or broadly reachable E-Business Suite environments because exploitation requires no credentials and can affect application data integrity.
Technical view
CVE-2020-14761 affects Oracle Applications Manager, Oracle Diagnostics Interfaces, in E-Business Suite 12.1.3 and 12.2.3 through 12.2.7. CVSS 3.1 is 6.5 with network, low-complexity, unauthenticated exploitation and no user interaction. Impacts are limited confidentiality and integrity; availability impact is not listed.
Likely exposure
Organizations running Oracle E-Business Suite with Oracle Applications Manager versions 12.1.3 or 12.2.3 through 12.2.7 are potentially exposed, especially where the affected HTTP interface is reachable from untrusted networks.
Exploitation context
The CVE states exploitation is easy, remote over HTTP, unauthenticated, and requires no user interaction. The provided sources do not show CISA KEV listing or confirmed active exploitation, so active exploitation should not be assumed.
Researcher notes
No CWE is provided in the source bundle. Analysis should stay scoped to Oracle Applications Manager, Oracle Diagnostics Interfaces, and the listed versions. The source bundle does not name a specific exploit, patch ID, workaround, or fixed version.
Mitigation direction
- Review Oracle's October 2020 Critical Patch Update guidance for this CVE.
- Apply applicable Oracle E-Business Suite security updates or vendor-directed remediation.
- Restrict HTTP access to Oracle Applications Manager from untrusted networks.
- Limit administrative interface exposure to trusted management networks.
- Monitor vendor advisories for any updated guidance or fixed-version details.
Validation and detection
- Inventory Oracle E-Business Suite instances and Applications Manager versions.
- Confirm whether versions 12.1.3 or 12.2.3 through 12.2.7 are present.
- Verify Oracle October 2020 CPU remediation status in patch records.
- Check whether Oracle Diagnostics Interfaces are reachable over HTTP.
- Review logs for suspicious unauthenticated access or unexpected data changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-14761 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N3.92.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuoct2020.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.