← Vulnerability feed

Vulnerability record · CVE-2020-2524 · published 15 April 2020

CVE-2020-2524: Oracle knowledge vulnerability

Oracle · Knowledge

Vulnerability in the Oracle Knowledge product of Oracle Knowledge (component: InQuira Search). Supported versions that are affected are 8.6.0-8.6.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Knowledge. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

5.9 CVSS 3.1 Medium EPSS 1.5% · top 25.6%
5.9CVSS 3.1 base score, v2 4.3
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Vulnerability in the Oracle Knowledge product of Oracle Knowledge (component: InQuira Search). Supported versions that are affected are 8.6.0-8.6.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Knowledge. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.oracle.com/security-alerts/cpuapr2020.html Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Vendor Advisory

Track CVE-2020-2524 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-2931Oracle knowledge vulnerabilityVulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Web Applications - InfoCenter). Supported versions that are affected ar…EPSS 2.8%9.8CVE-2020-2791Oracle knowledge vulnerabilityVulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Information Manager Console). Supported versions that are affected are …EPSS 2.2%7.5CVE-2019-0227Apache Axis 1.4 SSRF via AdminService (expired domain)Apache Axis 1.4, last released in 2006, contains a server-side request forgery flaw in its AdminService. The service can be induced to fetch a remote…EPSS 92%analysed6.5CVE-2016-3476Oracle knowledge vulnerabilityUnspecified vulnerability in the Oracle Knowledge component in Oracle Siebel CRM 8.5.x allows remote attackers to affect confidentiality and integrit…EPSS 1.9%6.3CVE-2020-2795Oracle knowledge vulnerabilityVulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Information Manager Console). Supported versions that are affected are …EPSS 0.72%6.1CVE-2019-11358jQuery extend() prototype pollution via unsanitized __proto__jQuery before 3.4.0 mishandles jQuery.extend(true, {}, ...) so that an unsanitized source object containing an enumerable __proto__ property can exte…EPSS 87%analysed6.1CVE-2018-8032Apache axis cross-site scripting vulnerabilityApache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.EPSS 11%5.9CVE-2020-2932Oracle knowledge vulnerabilityVulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Information Manager Console). Supported versions that are affected are …EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2020-2524), CISA KEV, FIRST EPSS (scores of 2026-11-14). This page is refreshed as NVD updates the record.