CVE-2020-5397: Oracle Application Testing Suite

Medium severity, CVSS 5.3. EPSS: 2.4% chance of exploitation in the next 30 days.

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.

Affected products

Oracle Application Testing Suite: version 13.3.0.1 only
Oracle Communications Brm - Elastic Charging Engine: version 11.3 only; version 12.0 only
Oracle Communications Diameter Signaling Router: from 8.0.0, up to and including 8.2.2
Oracle Communications Element Manager: version 8.1.1 only; version 8.2.0 only; version 8.2.1 only
Oracle Communications Policy Management: version 12.5.0 only
Oracle Communications Session Route Manager: version 8.1.1 only; version 8.2.0 only; version 8.2.1 only
Oracle Enterprise Manager Base Platform: version 13.2.1.0 only
Oracle Financial Services Regulatory Reporting With Agilereporter: version 8.0.9.2.0 only
Oracle Flexcube Private Banking: version 12.0.0 only; version 12.1.0 only
Oracle Healthcare Master Person Index: version 4.0.2 only
Oracle Insurance Calculation Engine: from 11.0.0, up to and including 11.3.1
Oracle Insurance Policy Administration j2ee: version 10.2.0 only; version 10.2.4 only; version 11.0.2 only; version 11.1.0 only; version 11.2.0 only
Oracle Insurance Rules Palette: version 10.2.0 only; version 10.2.4 only; version 11.0.2 only; version 11.1.0 only; version 11.2.0 only
Oracle MySQL Enterprise Monitor: from 4.0.0, up to and including 4.0.12; from 8.0.0, up to and including 8.0.20
Oracle Rapid Planning: version 12.1 only; version 12.2 only
Oracle Retail Assortment Planning: version 15.0 only; version 16.0 only
Oracle Retail Back Office: version 14.1 only
Oracle Retail Central Office: version 14.1 only
Oracle Retail Financial Integration: version 15.0 only; version 16.0 only
Oracle Retail Integration Bus: version 15.0.3 only; version 16.0.3 only
Oracle Retail Order Broker: version 15.0 only; version 16.0 only
Oracle Retail Point-Of-Service: version 14.1 only
Oracle Retail Predictive Application Server: version 14.0.3 only; version 14.1.3 only; version 15.0.3.0 only; version 16.0.3.0 only
Oracle Retail Returns Management: version 14.1 only
Oracle Retail Service Backbone: version 15.0 only; version 16.0 only
and 2 more

Published 2020-01-17. Last modified 2026-06-17.