CVE-2020-2764 Information disclosure in Java

What is CVE-2020-2764?

CVE-2020-2764 is a low-severity vulnerability in Oracle Corporation Java, published on 15 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vulnerability in the Java SE product of Oracle Java SE (component: Advanced Management Console). The supported version that is affected is Java Advanced Management Console: 2.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Which versions are affected by CVE-2020-2764?

It affects 1 product.

Products include Oracle Java Advanced Management Console.

How do I fix CVE-2020-2764?

No fix has been published for CVE-2020-2764 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-2764 being exploited?

There is no known exploitation of CVE-2020-2764 in the wild and no public exploit code.

Other vulnerabilities in Oracle Corporation Java

• CVE-2017-10104 Privilege escalation in Java High 7.4
• CVE-2017-10145 Missing authorization in Java High 7.4
• CVE-2019-2540 Missing authorization in Java Medium 6.1
• CVE-2017-10121 Missing authorization in Java Medium 6.1
• CVE-2017-10342 Denial of service in Java Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5r94-732v-9hm6.