^{CVE-2020-14890:}Oracle FLEXCUBE Direct Banking Pre Login Component Vulnerability

Overview

This vulnerability in Oracle FLEXCUBE Direct Banking affects the Pre Login component, which is a critical entry point to the banking application. The vulnerability has a CVSS 3.1 Base Score of 6.5, indicating a medium to high severity. The attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring no privileges (PR:N), but does need user interaction (UI:R). The scope is unchanged (S:U), with high confidentiality impact (C:H), but no impact on integrity (I:N) or availability (A:N).

The vulnerability likely involves some form of social engineering that tricks users into taking actions that would grant the attacker access to sensitive banking data. Since this affects the Pre Login component, it could potentially involve phishing, session hijacking, or other techniques that target users before they fully authenticate to the system.

Remediation

Organizations using affected versions of Oracle FLEXCUBE Direct Banking (12.0.1, 12.0.2, and 12.0.3) should:

1. Apply the security patches provided in the Oracle Critical Patch Update (CPU) from October 2020.
2. Upgrade to the latest version of Oracle FLEXCUBE Direct Banking if available.
3. Implement additional security controls such as:
   • Web Application Firewalls (WAF) to filter malicious traffic
   • Enhanced user education regarding phishing and social engineering attacks
   • Multi-factor authentication where possible
   • Network segmentation to limit access to the banking application
4. Monitor for suspicious activities, especially those targeting the Pre Login component.
5. Consider implementing additional logging and alerting for activities related to data access.

References

1. Oracle Critical Patch Update Advisory - October 2020: https://www.oracle.com/security-alerts/cpuoct2020.html
2. CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
3. Oracle Financial Services Applications Security Documentation