CVE-2020-2882: Oracle E-Business Suite Human Resources Hierarchy Diagrammers flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.1 with high confidentiality and integrity impact and a very high EPSS percentile, though no KEV listing or known exploit details reduce certainty.

What it is

Oracle Human Resources in Oracle E-Business Suite contains a vulnerability in the Hierarchy Diagrammers component affecting versions 12.1.1-12.1.3 and 12.2.3-12.2.9. A low-privileged attacker with network access via HTTP can compromise the product, leading to unauthorized creation, deletion, modification, and access to critical data. The record does not specify the underlying weakness beyond NVD-CWE-noinfo.

Impact

An attacker gains unauthorized read and write access to Oracle Human Resources data, including the ability to create, delete, or modify critical records. This can result in full compromise of the confidentiality and integrity of the affected HR data.

Attack surface

Reachable over the network via HTTP with a low-privileged authenticated account; no user interaction is required per the CVSS vector. The specific endpoint or component entry point is not detailed in the record.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is 0.4654 (98.8th percentile), indicating a high predicted likelihood of exploitation activity, though no public exploit details are provided in the references.

What to do

• Apply the Oracle April 2020 Critical Patch Update (cpuapr2020) for Oracle E-Business Suite Human Resources.
• Restrict network access to the affected HTTP endpoints to trusted users and networks.
• Review and minimize privileges for accounts that can access the Hierarchy Diagrammers component.
• Monitor for anomalous data modification or access events in Oracle Human Resources.
• Verify affected versions 12.1.1-12.1.3 and 12.2.3-12.2.9 are patched or isolated.

Detection

• Monitor HTTP requests to Oracle E-Business Suite HR endpoints for unusual patterns or payloads from low-privileged accounts.
• Audit database and application logs for unexpected create, delete, or modify operations on HR hierarchy data.
• Alert on access to Hierarchy Diagrammers functionality outside normal business hours or from unusual source IPs.
• Correlate authentication events with subsequent data modification activity for low-privileged HR users.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.