CVE-2024-20910 Information disclosure in Audit Vault and Database Firewall

Low 3.0 Published 16 Jan 2024 Updated 3 Jun 2025

High-privileged attackers can gain unauthorized read access to subset of data in Oracle Audit Vault and Database Firewall.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-20910?

CVE-2024-20910 is a low-severity vulnerability in Oracle Corporation Audit Vault and Database Firewall, published on 16 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). Supported versions that are affected are 20.1-20.9. Difficult to exploit vulnerability allows high privileged attacker with network access via Oracle Net to compromise Oracle Audit Vault and Database Firewall. While the vulnerability is in Oracle Audit Vault and Database Firewall, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Audit Vault and Database Firewall accessible data. CVSS 3.1 Base Score 3.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N).

Weakness: CWE-200

Which versions are affected by CVE-2024-20910?

It affects 1 product.

Products include Oracle Audit Vault and Database Firewall.

How do I fix CVE-2024-20910?

No fix has been published for CVE-2024-20910 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-20910 being exploited?

There is no known exploitation of CVE-2024-20910 in the wild and no public exploit code.

Sources

Also known as GHSA-6h64-v4gr-6gvr.