Security readout for executives and security teams
Plain-English summary
CVE-2020-2939 affects Oracle Financial Services Asset Liability Management 8.0.6 and 8.0.7. A low-privileged user who can reach the HTTP user interface could alter critical application data and read some accessible data. The main business risk is unauthorized manipulation of financial risk or asset-liability records.
Executive priority
Treat this as high priority for financial-services environments because integrity impact is high. Remediation urgency depends on whether affected versions are deployed and how widely the HTTP interface is reachable.
Technical view
The issue is in the User Interface component of Oracle Financial Services Asset Liability Management. CVSS 3.0 is 7.1, with network attack vector, low complexity, low privileges, no user interaction, low confidentiality impact, and high integrity impact. Availability impact is not indicated.
Likely exposure
Exposure is limited to organizations running Oracle Financial Services Asset Liability Management 8.0.6 or 8.0.7 with reachable HTTP UI access. Internet or broad internal access increases risk, but the source bundle does not confirm deployment patterns.
Exploitation context
The CVE states the issue is easily exploitable by a low-privileged attacker over HTTP. The bundle does not show CISA KEV listing or other evidence of active exploitation, so active exploitation should not be assumed.
Researcher notes
The source bundle identifies affected versions, component, CVSS vector, and impact, but does not include CWE, root cause, proof-of-concept details, or exact fixed build. Avoid assuming exploit availability or a specific patch number without Oracle advisory details.
Mitigation direction
- Check Oracle April 2020 CPU guidance for the applicable patch or supported upgrade path.
- Prioritize remediation for any 8.0.6 or 8.0.7 instance with broad HTTP access.
- Restrict UI access to trusted networks and administrative users where feasible.
- Review low-privileged roles and remove unnecessary access.
- Increase monitoring for unauthorized data creation, deletion, modification, or unusual reads.
Validation and detection
- Inventory Oracle Financial Services Asset Liability Management versions in use.
- Confirm whether any instance is version 8.0.6 or 8.0.7.
- Verify Oracle April 2020 CPU remediation status with Oracle support or patch records.
- Map which networks can reach the HTTP user interface.
- Review application audit logs for suspicious critical-data changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-2939 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N2.84.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
7.1HighVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuapr2020.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.