CVE-2020-2734

lowpriority · track · 10EPSS 0.009 · 59 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.89% (59th) EPSS

CVSS 3.5 · low

Is it mine?

12 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-28

Vulnerability in the RDBMS/Optimizer component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Execute on DBMS_SQLTUNE privilege with network access via Oracle Net to compromise RDBMS/Optimizer. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of RDBMS/Optimizer accessible data. CVSS 3.0 Base Score 2.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).

cvss

Technical severity, 0–10. One row per scoring source.

3.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.03.5lowAV:N/AC:M/Au:S/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 6.8 · impact 2.9

v3.12.4lowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:Nprimary · NVD / NIST USexploitability 0.9 · impact 1.4

v3.02.4lowCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.02.4lowCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:Nsecondary · secalert_us@oracle.com USexploitability 0.9 · impact 1.4

v3.12.4lowAV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.12.2lowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-264US

affected products (12)

Products and version ranges known to be affected.

Oracle Corporation Oracle Database≤ 12.2.0.1enisa_euvdEU
Oracle Corporation Oracle Database≤ 12.1.0.2enisa_euvdEU
Oracle Corporation Oracle Database≤ 19cenisa_euvdEU
Oracle Corporation Oracle Database≤ 18cenisa_euvdEU
Oracle Corp. Database Server≤ 19cfstec_bduRU
Oracle Corp. Database Server≤ 18cfstec_bduRU
Oracle Corp. Database Server≤ 12.2.0.1fstec_bduRU
Oracle Corp. Database Server≤ 12.1.0.2fstec_bduRU
oracle database server= 12.1.0.2nvdUScpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*
oracle database server= 12.2.0.1nvdUScpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*
oracle database server= 18cnvdUScpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*
oracle database server= 19cnvdUScpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2020-04-15modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan