CVE-2020-2642

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager versions 12.1.0.5, 13.2.0.0, 13.3.0.0

Description The issue is related to a component of the Enterprise Manager Base Platform product, specifically the Connector Framework, and is associated with inadequate access control. This allows a high-privileged attacker with network access via HTTP to compromise the Enterprise Manager Base Platform, resulting in unauthorized access to critical data, complete access to all accessible data, and the ability to update, insert, or delete some accessible data. Additionally, it can cause a partial denial of service.

Recommendations For versions 12.1.0.5, 13.2.0.0, and 13.3.0.0, consider restricting access to the Connector Framework component to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the HTTP access to the Enterprise Manager Base Platform until the issue is resolved. Restrict access to sensitive data and ensure that only authorized personnel have access to the Enterprise Manager Base Platform.