CVE-2020-2846

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Depot Repair. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Depot Repair, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Depot Repair accessible data as well as unauthorized update, insert or delete access to some of Oracle Depot Repair accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Apr 15, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-284608.1This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object CVE-2020-284619.8This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , theyCVE-2020-284629.8This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , tCVE-2020-284636.5All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchCVE-2020-284649.8This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machiCVE-2020-284667.5This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs thCVE-2020-284689.8This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side CVE-2020-284697.5This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separatCVE-2020-28478.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions thaCVE-2020-284706.1This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then writtenCVE-2020-284719.8This affects the package properties-reader before 2.2.0.CVE-2020-284729.8This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a mal
CVE-2020-2846: High severity, CVSS 8.2 | Vulnix