Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-2599: Oracle Hospitality Cruise Materials Management allows physical data breach

CVE-2020-2599 · published 6 years ago

Summary

The Oracle Hospitality Cruise Materials Management system (version 7.30.567) can be compromised by someone with physical access to the equipment. An attacker could view or take control of the system’s data without needing network access. To protect against this, limit physical access to the servers and apply any available patches or configuration hardening from Oracle.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle	hospitality_cruise_materials_management	7.30.567 `cpe:2.3:a:oracle:hospitality_cruise_materials_management:7.30.567:::::::*`

Original advisory text

Vulnerability in the Oracle Hospitality Cruise Materials Management product of Oracle Hospitality Applications (component: MMS All). The supported version that is affected is 7.30.567. Difficult to exploit vulnerability allows physical access to compromise Oracle Hospitality Cruise Materials Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Materials Management accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

References

https://www.oracle.com/security-alerts/cpujan2020.html Patch Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.2 Medium

Exploitation

<1% chance of attack within 30 days

Timeline

Published15 Jan 2020

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2020-2599 · NVD

Track software like this

Free during beta