WaratekVRT Sign in

CVE-2020-2734 Oracle Database Server

Affected softwareOracle Database Server
Affected versions12.1.0.2, 12.2.0.1, 18c, 19c
Severity2.4 Low CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update April 2020
Published15 Apr 2020
Updated17 Jun 2026

Description

Vulnerability in the RDBMS/Optimizer component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Execute on DBMS_SQLTUNE privilege with network access via Oracle Net to compromise RDBMS/Optimizer. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS/Optimizer accessible data. CVSS 3.0 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.89% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

2.4 LOW v3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 2.4 LOW CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N NVD Primary published
CVSS 3.0 2.4 LOW CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N secalert_us@oracle.com Secondary
CVSS 2.0 3.5 none AV:N/AC:M/Au:S/C:P/I:N/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2020 ↗ CPU 2020-Q2 Oracle Database Server / RDBMS/Optimizer (12.1.0.2, 12.2.0.1, 18c, 19c)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Database Server RDBMS/Optimizer 12.1.0.2, 12.2.0.1, 18c, 19c 12.1.0.2 · 12.2.0.1 · 18 · 19

Products and versions

1 product, 4 version entries
SourceVendorProductSchemeAffected versions
nvd oracle database server generic 12.1.0.2 · 12.2.0.1 · 18c · 19c

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** EXECUTE ON DBMS_SQLTUNE, ORACLE NET **Products:** ORACLE DATABASE SERVER, RDBMS/OPTIMIZER

References

URLTags
https://www.oracle.com/security-alerts/cpuapr2020.html Vendor Advisory

Timeline
Published2020-04-15By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.