Security readout for executives and security teams
Plain-English summary
CVE-2020-2706 affects Oracle Primavera P6 Enterprise Project Portfolio Management. A low-privileged attacker with network access over HTTP could, with another user’s interaction, read some accessible data and make limited unauthorized data changes. The issue is not listed in KEV in the provided bundle.
Executive priority
Treat as a moderate-priority remediation item. Prioritize exposed or business-critical Primavera P6 EPPM environments because the vulnerability can affect project data confidentiality and integrity, but the provided evidence does not support emergency action for active exploitation.
Technical view
The affected component is Project Manager in Primavera P6 EPPM versions 16.2.0.0-16.2.19.3, 17.12.0.0-17.12.17.0, 18.8.0.0-18.8.18.0, 19.12.1.0-19.12.3.0, and 20.1.0.0-20.2.0.0. CVSS 3.0 is 5.4: network, low complexity, low privileges, user interaction required, changed scope, low confidentiality and integrity impact.
Likely exposure
Exposure is most likely where affected Primavera P6 EPPM versions are deployed and reachable over HTTP by authenticated low-privileged users. Internet-facing or broadly accessible internal deployments carry higher practical concern because the attack vector is network-accessible.
Exploitation context
The provided sources do not show active exploitation, public exploit availability, or CISA KEV inclusion. Exploitation requires low privileges and human interaction by someone other than the attacker, reducing urgency compared with unauthenticated server-side flaws but not eliminating business risk.
Researcher notes
The bundle does not provide CWE mapping, exploit details, root cause, or fixed version identifiers beyond the Oracle CPU reference. Analysis should stay anchored to the CVSS vector and affected version ranges until Oracle advisory details are verified in the target environment.
Mitigation direction
- Review Oracle’s April 2020 CPU guidance for CVE-2020-2706.
- Apply the Oracle-recommended Primavera P6 EPPM update or patch for affected versions.
- Restrict HTTP access to Primavera P6 EPPM to trusted networks and users.
- Review low-privileged account access and remove unnecessary accounts.
- Monitor vendor guidance for any later remediation notes or compensating controls.
Validation and detection
- Inventory Primavera P6 EPPM deployments and record exact installed versions.
- Confirm whether any listed affected version ranges are present.
- Check whether Primavera P6 EPPM is reachable over HTTP from untrusted networks.
- Review access logs for unusual low-privileged activity against Project Manager workflows.
- Verify Oracle CPU remediation status in patch management records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-2706 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
5.4MediumVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuapr2020.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.