APP: Oracle Coherence CVE-2020-14756 IIOP Insecure Deserialization
This signature detects attempts to exploit a known vulnerability against Oracle Coherence Server. A successful attack can lead to arbitrary code execution.
Extended Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Products
Oracle utilities_framework
References
CVE: CVE-2020-14756
URL: https://www.oracle.com/security-alerts/cpujan2021.html#AppendixFMW
Short Name
APP:ORACLE:COHERENCE-IIOP-INDES
Severity
Major
Recommended
True
Recommended Action
Drop
Category
APP
Keywords
CVE-2020-14756 Coherence Deserialization IIOP Insecure Oracle
Release Date
02/09/2021
Supported Platforms
srx-branch-19.3
vsrx3bsd-19.2
srx-19.4
vsrx3bsd-19.4
srx-branch-19.4
vsrx-19.4
vsrx-19.2
srx-19.3
srx-branch-12.3
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx-12.3
vmx-19.3
srx-12.3
Sigpack Version
3590
False Positive
Unknown
Vendors
Oracle
CVSS Score
7.5