{"id":"CVE-2020-14756","published":"2021-01-20T14:49:58Z","modified":"2024-09-26T18:46:41Z","title":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components)","vendor":"Oracle Corporation","product":"Utilities Framework","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"Utilities Framework","versions":["4.2.0.2.0","4.2.0.3.0","4.3.0.1.0-4.3.0.6.0","4.4.0.0.0","4.4.0.2.0","4.4.0.3.0"]}],"description":{"text":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the Core Components of Oracle Coherence, part of Oracle Fusion Middleware, affects supported versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via IIOP or T3 can easily exploit it to take over Oracle Coherence.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:58Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.74753,"percentile":0.99503,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-11-20","exploitedFirstSeen":"2024-11-20","ransomware":false,"evidence":[{"url":"https://go.catonetworks.com/rs/245-RJK-441/images/CATO_CTRL_Report_Q3_2024.pdf","date":"2024-11-20"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-6892","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-6892","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2021-01-27","earliestUrl":"https://github.com/Y4er/CVE-2020-14756","repos":[{"name":"Y4er/CVE-2020-14756","url":"https://github.com/Y4er/CVE-2020-14756","stars":79,"created":"2021-01-27"},{"name":"somatrasss/weblogic2021","url":"https://github.com/somatrasss/weblogic2021","stars":12,"created":"2021-02-04"}]},"first":{"date":"2021-01-27","source":"PoC-in-GitHub","url":"https://github.com/Y4er/CVE-2020-14756"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-01-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-14756","provenance":"source"},{"date":"2021-01-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Y4er/CVE-2020-14756","provenance":"source"},{"date":"2024-11-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://go.catonetworks.com/rs/245-RJK-441/images/CATO_CTRL_Report_Q3_2024.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":7,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 711 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9950"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}