Cyber Resilience

CVE-2020-11998

Oracle Flexcube Private Banking 12.0.0 … 12.1.0

High EPSS
Published
10 September 2020
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.51 99th percentile
Risk Priority 84 floored blend · peak EPSS

Summary

CVE-2020-11998 is a critical-severity an unspecified weakness vulnerability in Oracle Flexcube Private Banking. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client…

more

could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13

CWE(s)
NVD-CWE-noinfo

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated remote JMX/RMI exposure allows attackers to load and execute arbitrary code via MLet MBeans.
attack.mitre.org →
T1059 Command and Scripting Interpreter Executionconfidence: MEDIUM
Successful exploitation results in arbitrary code execution on the ActiveMQ host.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Remote code execution via exposed management interface yields privilege escalation on the server.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2020-17530Same vendor: Apache
CVE-2021-41303Same vendor: Apache
CVE-2019-0230Same vendor: Apache
CVE-2016-3081Same vendor: Apache
CVE-2019-17558Same vendor: Apache
CVE-2013-7285Same product: Apache Activemq
CVE-2026-50734Same product: Apache Activemq
CVE-2026-49157Same product: Apache Activemq
CVE-2026-53916Same product: Apache Activemq
CVE-2026-49877Same product: Apache Activemq

Affected Assets

apache
activemq
5.15.12
oracle
communications diameter signaling router
8.0.0 — 8.5.0
oracle
communications element manager
8.2.0 — 8.2.4.0
oracle
communications session report manager
8.0.0 — 8.2.2
oracle
communications session route manager
8.0.0 — 8.2.2
oracle
enterprise repository
11.1.1.7.0
oracle
flexcube private banking
12.0.0, 12.1.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References