CVE-2020-2587 is a critical vulnerability affecting Oracle Human Resources in Oracle E-Business Suite versions 12.1.1-12.1.3 and 12.2.3-12.2.9, specifically within the Hierarchy Diagrammers component. This easily exploitable flaw allows low-privileged attackers with network access via HTTPS to compromise the system. Successful exploitation can lead to unauthorized data creation, deletion, modification, and access to critical or all Human Resources data, as well as a partial denial of service. The vulnerability carries a CVSS 3.0 Base Score of 9.9 (Critical), indicating severe impacts on Confidentiality, Integrity, and Availability. Its attack vector is network-based with low attack complexity and no user interaction required. While the vulnerability is in Human Resources, attacks may significantly impact additional products. Currently, there is no known active exploitation (KEV: No) and no public exploit code available in Metasploit, Nuclei, or ExploitDB. Despite this, it has garnered some community discussion and media coverage, with one article from SecurityWeek highlighting its potential to allow tampering with financial records.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 12.1.1, <= 12.1.3CPE matchmatch criteria | cpe:2.3:a:oracle:human_resources:*:*:*:*:*:*:*:* | ||
>= 12.2.3, <= 12.2.9CPE matchmatch criteria | cpe:2.3:a:oracle:human_resources:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 1.0 Bluesky, 0.5 Mastodon, and 1.6 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.