Vulnerability in Oracle Primavera_p6_enterprise_project_portfolio_management
CVE-2020-2556
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Core). Supported versions that are affected are 16.2.0.0-16.2.19.0, 17.12.0.0-17.12.16.0, 18.8.0.0-18.8.16…
EPSS: 0.004 (34.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L.
Affected products
- Oracle Primavera_p6_enterprise_project_portfolio_management — versions 19.12.0.0, 20.1.0.0
- Oracle Corporation Primavera P6 Professional Project Management — versions 16.2.0.0-16.2.19.0, 17.12.0.0-17.12.16.0, 18.8.0.0-18.8.16.0
Public proof-of-concept exploits
References
- secalert_us@oracle.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-2556?
- CVE-2020-2556 is a high-severity vulnerability in Oracle Primavera_p6_enterprise_project_portfolio_management. CVSS score: 7.3/10. Published 2020-01-15.
- How severe is CVE-2020-2556?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2020-2556 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.