CVE-2020-5413

Published on: 07/31/2020 12:00:00 AM UTC

Last Modified on: 12/02/2021 10:19:00 PM UTC

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Certain versions of Banking Corporate Lending Process Management from Oracle contain the following vulnerability:

Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.

  • CVE-2020-5413 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as CRITICAL severity.
  • Affected Vendor/Software: URL Logo Spring by VMware - Spring Integration version < v4.3.23.RELEASE
  • Affected Vendor/Software: URL Logo Spring by VMware - Spring Integration version < v5.1.12.RELEASE
  • Affected Vendor/Software: URL Logo Spring by VMware - Spring Integration version < v5.2.8.RELEASE
  • Affected Vendor/Software: URL Logo Spring by VMware - Spring Integration version < v5.3.2.RELEASE

CVSS3 Score: 9.8 - CRITICAL

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
NETWORK LOW NONE NONE
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED HIGH HIGH HIGH

CVSS2 Score: 7.5 - HIGH

Access
Vector
Access
Complexity
Authentication
NETWORK LOW NONE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
PARTIAL PARTIAL PARTIAL

CVE References

Description Tags Link
Oracle Critical Patch Update Advisory - July 2021 www.oracle.com
text/html
URL Logo MISC www.oracle.com//security-alerts/cpujul2021.html
Oracle Critical Patch Update Advisory - October 2021 www.oracle.com
text/html
URL Logo MISC www.oracle.com/security-alerts/cpuoct2021.html
CVE-2020-5413: Kryo Configuration Allows Code Execution with Unknown “Serialization Gadgets” | Security | VMware Tanzu Vendor Advisory
tanzu.vmware.com
text/html
URL Logo CONFIRM tanzu.vmware.com/security/cve-2020-5413
Oracle Critical Patch Update Advisory - April 2021 www.oracle.com
text/html
URL Logo MISC www.oracle.com/security-alerts/cpuApr2021.html

Related QID Numbers

  • 980322 Java (maven) Security Update for org.springframework.integration:spring-integration-core (GHSA-86qr-9vqc-pgc6)

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationOracleBanking Corporate Lending Process Management14.2.0AllAllAll
ApplicationOracleBanking Corporate Lending Process Management14.3.0AllAllAll
ApplicationOracleBanking Corporate Lending Process Management14.5.0AllAllAll
ApplicationOracleBanking Credit Facilities Process Management14.2.0AllAllAll
ApplicationOracleBanking Credit Facilities Process Management14.3.0AllAllAll
ApplicationOracleBanking Credit Facilities Process Management14.5.0AllAllAll
ApplicationOracleBanking Supply Chain Finance14.2.0AllAllAll
ApplicationOracleBanking Supply Chain Finance14.3.0AllAllAll
ApplicationOracleBanking Supply Chain Finance14.5.0AllAllAll
ApplicationOracleBanking Virtual Account Management14.2.0AllAllAll
ApplicationOracleBanking Virtual Account Management14.3.0AllAllAll
ApplicationOracleBanking Virtual Account Management14.5.0AllAllAll
ApplicationOracleFlexcube Private Banking12.0.0AllAllAll
ApplicationOracleFlexcube Private Banking12.1.0AllAllAll
ApplicationOracleRetail Customer Management And Segmentation FoundationAllAllAllAll
ApplicationOracleRetail Merchandising System16.0.3AllAllAll
ApplicationVmwareSpring IntegrationAllAllAllAll
ApplicationVmwareSpring IntegrationAllAllAllAll
ApplicationVmwareSpring IntegrationAllAllAllAll
ApplicationVmwareSpring IntegrationAllAllAllAll
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:*:
  • cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*:
  • cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*:
  • cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*:
  • cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*:
  • cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*:

Social Mentions

Source Title Posted (UTC)
© CVE.report 2022 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report