CVE-2020-14871

2020-10-2114:04:29

oracle

github.com

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

7.9

Confidence

Low

EPSS

0.863

Percentile

98.6%

SSVC

Exploitation

active

Automatable

Technical Impact

total

JSON

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*"
    ],
    "vendor": "oracle",
    "product": "solaris",
    "versions": [
      {
        "status": "affected",
        "version": "10"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*"
    ],
    "vendor": "oracle",
    "product": "solaris",
    "versions": [
      {
        "status": "affected",
        "version": "11"
      }
    ],
    "defaultStatus": "unknown"
  }
]