CVE-2020-2604

EPSS 1.36%
Published 15.01.2020 17:15:20
Last modified 21.11.2024 05:25:42
Source secalert_us@oracle.com
Teams watchlist Login
Open Login

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products Warnungen 0 Metrics 4 CWE 1 References 27

Data is provided by the National Vulnerability Database (NVD)

Oracle ≫ Commerce Experience Manager Version11.3.2

Oracle ≫ Commerce Guided Search Version11.3.2

Oracle ≫ Graalvm Version19.3.0.2 SwEditionenterprise

Oracle ≫ Jdk Version1.7.0 Updateupdate241

Oracle ≫ Jdk Version1.8.0 Updateupdate231

Oracle ≫ Jdk Version11.0.5

Oracle ≫ Jdk Version13.0.1

Oracle ≫ Jre Version1.8.0 Updateupdate231

Redhat ≫ Enterprise Linux Version8.0

Redhat ≫ Enterprise Linux Desktop Version6.0

Redhat ≫ Enterprise Linux Desktop Version7.0

Redhat ≫ Enterprise Linux Eus Version7.7

Redhat ≫ Enterprise Linux Eus Version8.1

Redhat ≫ Enterprise Linux Server Version6.0

Redhat ≫ Enterprise Linux Server Version7.0

Redhat ≫ Enterprise Linux Server Aus Version7.7

Redhat ≫ Enterprise Linux Server Tus Version7.7

Redhat ≫ Enterprise Linux Workstation Version6.0

Redhat ≫ Enterprise Linux Workstation Version7.0

Oracle ≫ Openjdk Version >= 11 <= 11.0.5

Oracle ≫ Openjdk Version >= 13 <= 13.0.1

Oracle ≫ Openjdk Version7 Update-

Oracle ≫ Openjdk Version7 Updateupdate241

Oracle ≫ Openjdk Version7 Updateupdate80

Oracle ≫ Openjdk Version7 Updateupdate85

Oracle ≫ Openjdk Version8 Update-

Oracle ≫ Openjdk Version8 Updateupdate102

Oracle ≫ Openjdk Version8 Updateupdate112

Oracle ≫ Openjdk Version8 Updateupdate152

Oracle ≫ Openjdk Version8 Updateupdate162

Oracle ≫ Openjdk Version8 Updateupdate172

Oracle ≫ Openjdk Version8 Updateupdate192

Oracle ≫ Openjdk Version8 Updateupdate20

Oracle ≫ Openjdk Version8 Updateupdate202

Oracle ≫ Openjdk Version8 Updateupdate212

Oracle ≫ Openjdk Version8 Updateupdate222

Oracle ≫ Openjdk Version8 Updateupdate232

Oracle ≫ Openjdk Version8 Updateupdate40

Oracle ≫ Openjdk Version8 Updateupdate60

Oracle ≫ Openjdk Version8 Updateupdate66

Oracle ≫ Openjdk Version8 Updateupdate72

Oracle ≫ Openjdk Version8 Updateupdate92

Debian ≫ Debian Linux Version8.0

Debian ≫ Debian Linux Version9.0

Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version19.10

Opensuse ≫ Leap Version15.1

Netapp ≫ Active Iq Unified Manager SwPlatformwindows Version >= 7.3

Netapp ≫ Active Iq Unified Manager SwPlatformvmware_vsphere Version >= 9.5

Netapp ≫ E-series Performance Analyzer Version-

Netapp ≫ E-series Santricity Management Plug-ins Version- SwPlatformvmware_vcenter

Netapp ≫ E-series Santricity Os Controller Version >= 11.0.0 <= 11.60.1

Netapp ≫ E-series Santricity Storage Manager Version-

Netapp ≫ E-series Santricity Web Services Proxy Version-

Netapp ≫ Oncommand Insight Version-

Netapp ≫ Oncommand Workflow Automation Version-

Netapp ≫ Santricity Unified Manager Version-

Netapp ≫ Steelstore Cloud Integrated Storage Version-

Mcafee ≫ Epolicy Orchestrator Version5.9.0

Mcafee ≫ Epolicy Orchestrator Version5.9.1

Mcafee ≫ Epolicy Orchestrator Version5.10.0 Update-

Mcafee ≫ Epolicy Orchestrator Version5.10.0 Updateupdate_1

Mcafee ≫ Epolicy Orchestrator Version5.10.0 Updateupdate_2

Mcafee ≫ Epolicy Orchestrator Version5.10.0 Updateupdate_3

Mcafee ≫ Epolicy Orchestrator Version5.10.0 Updateupdate_4

Mcafee ≫ Epolicy Orchestrator Version5.10.0 Updateupdate_5

Mcafee ≫ Epolicy Orchestrator Version5.10.0 Updateupdate_6

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	1.36%	0.796

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.1	2.2	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P
secalert_us@oracle.com	8.1	2.2	5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H