CVE-2020-2816

HIGH

Oracle JDK 11.0.6 and 14 - Unauthenticated Data Manipulation via JSSE HTTPS

Title source: llm
STIX 2.1

Description

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

References (5)

Core 5
Core References
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20200416-0004/
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4662
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4337-1/
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html

Scores

CVSS v3 7.5
EPSS 0.0071
EPSS Percentile 72.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

Status published
Products (25)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.10
debian/debian_linux 10.0
netapp/7-mode_transition_tool
netapp/active_iq_unified_manager 7.3
netapp/active_iq_unified_manager 9.5
netapp/cloud_backup
netapp/e-series_performance_analyzer
netapp/e-series_santricity_os_controller 11.0.0 - 11.60.1
... and 15 more
Published Apr 15, 2020
Tracked Since Feb 18, 2026