CVE-2020-9315
HighPRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys.
Published May 10, 2020 · Updated Nov 21, 2024
Key Facts
Patch immediately- CVE-2020-9315 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Iplanet Web Server (Oracle).
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 82% probability of exploitation in the next 30 days.
- Fixed versions are available, including Iplanet Web Server <=7.0.27, Iplanet Web Server 7.0.27.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
82%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-9315 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE.
Affected Products
1 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Iplanet Web ServerOracle | See advisory | 7.0.27 |
Patched Releases
Iplanet Web Server
<=7.0.27
Timeline
Publicly disclosed
May 10, 2020
Last updated
Nov 21, 2024
Weakness Type
- CWE-306 Missing Authentication for Critical Function
References
- advisory20200512 Two vulnerabilities in Oracle's iPlanet Web Server (CVE-2020-9315 and CVE-2020-9314)
- advisoryhttps://www.oracle.com/support/lifetime-support/
- advisoryhttps://www.oracle.com/us/assets/lifetime-support-middleware-069163.pdf
- advisoryhttps://wwws.nightwatchcybersecurity.com/2020/05/10/two-vulnerabilities-in-oracles-iplanet-web-server-cve-2020-9315-and-cve-2020-9314/
FAQ
Common Questions.
PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys.
Affected: Iplanet Web Server (Oracle). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Iplanet Web Server <=7.0.27, Iplanet Web Server 7.0.27.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-9315 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo