WaratekVRT Sign in

CVE-2020-14580 Oracle Communications Session Border Controller

Affected softwareOracle Communications Session Border Controller
Affected versions8.1.0, 8.2.0, 8.3.0
Severity8.2 High CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update July 2020
Published15 Jul 2020
Updated17 Jun 2026

Description

Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications Applications (component: System Admin). Supported versions that are affected are 8.1.0, 8.2.0 and 8.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via SSH to compromise Oracle Communications Session Border Controller. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Session Border Controller, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Session Border Controller accessible data as well as unauthorized update, insert or delete access to some of Oracle Communications Session Border Controller accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Session Border Controller. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L).

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.98% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

8.2 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L secalert_us@oracle.com Secondary published
CVSS 3.1 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L NVD Primary
CVSS 2.0 6.0 none AV:N/AC:M/Au:S/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Communications Applications / System Admin (8.1.0, 8.2.0, 8.3.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications System Admin 8.1.0, 8.2.0, 8.3.0 8.1.0 · 8.2.0 · 8.3.0

Products and versions

1 product, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle communications applications generic 8.1.0 · 8.2.0 · 8.3.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** SSH, SYSTEM ADMIN **Products:** ORACLE COMMUNICATIONS SESSION BORDER CONTROLLER, ORACLE COMMUNICATIONS APPLICATIONS

References

URLTags
https://www.oracle.com/security-alerts/cpujul2020.html Patch, Vendor Advisory

Timeline
Published2020-07-15By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.