CVE-2020-7226: oracle communications_services_gatekeeper
CVSS: 7.5v3.1HighModified
AliasesGHSA-x64g-4xx9-fh6x
Published 24-01-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-7226 is a high (CVSS 7.5) vulnerability in oracle communications_services_gatekeeper. EPSS estimates a 3.33% chance of exploitation in the next 30 days, higher than 88.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
3.33%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 6Timeline
- 24-01-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 2 agree
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
3.33%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.33% on 21-09-2026
21-09-202621-10-2026
EPSS score3.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCryptacular
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Oracle3 products
- communications_services_gatekeeper7.0
- webcenter_sites12.2.1.3.0 | 12.2.1.4.0
- weblogic_server12.2.1.4.0 | 14.1.1.0.0
Org.cryptacular1 product
- cryptacular< 1.1.4 | ≥ 1.2.0, < 1.2.4
Vt1 product
- cryptacular< 1.1.4 | ≥ 1.2.0, < 1.2.4
3 vendors · 5 products
References
34 linksShow all 34 references
- github.com/vt-middleware/cryptacular/blob/master/src/main/java/org/cryptacular/CiphertextHeader.javaX Refsource MISCWEBExploitThird Party Advisory
- github.com/apereo/cas/commit/8810f2b6c71d73341d4dde6b09a18eb46cfd6d45X Refsource MISCWEBPatchThird Party Advisory
- github.com/apereo/cas/commit/93b1c3e9d90e36a19d0fa0f6efb863c6f0235e75X Refsource MISCWEBPatchThird Party Advisory
- github.com/apereo/cas/commit/a042808d6adbbf44753d52c55cac5f533e24101fX Refsource MISCWEBPatchThird Party Advisory
