WaratekVRT Sign in

CVE-2020-2978 Oracle Database

Affected softwareOracle Database
Affected versions12.1.0.2, 12.2.0.1, 18c, 19c
Severity4.1 Medium CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update July 2020
Published15 Jul 2020
Updated17 Jun 2026

Description

Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA role account privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition. While the vulnerability is in Oracle Database - Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database - Enterprise Edition accessible data. CVSS 3.1 Base Score 4.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N).

Exploitation status

No public exploit

No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed, none at 5+ stars
  • EPSS 1.2% chance in 30 days

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC CVE-2020-2978 2020-12-18

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

4.1 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 4.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N secalert_us@oracle.com Secondary published
CVSS 3.1 4.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N NVD Secondary
CVSS 2.0 4.0 none AV:N/AC:L/Au:S/C:N/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Database Server / Oracle Database - Enterprise Edition (12.1.0.2, 12.2.0.1, 18c, 19c)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Database Server Oracle Database - Enterprise Edition 12.1.0.2, 12.2.0.1, 18c, 19c 12.1.0.2 · 12.2.0.1 · 18 · 19

Products and versions

1 product, 4 version entries
SourceVendorProductSchemeAffected versions
nvd oracle database generic 12.1.0.2 · 12.2.0.1 · 18c · 19d

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** DBA ROLE ACCOUNT, ORACLE NET **Products:** ORACLE DATABASE SERVER, ORACLE DATABASE - ENTERPRISE EDITION

References

URLTags
http://packetstormsecurity.com/files/172183/Oracle-RMAN-Missing-Auditing.html
https://databasesecurityninja.wordpress.com/2020/12/01/cve-2020-2978-rman-audit-table-point-in-time-recovery-not-logged/ Exploit, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch, Vendor Advisory

Timeline
Published2020-07-15By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.