CVE-2020-14740: 
Oracle Sql Developer vulnerability analysis and mitigation

Vulnerability in the SQL Developer Install component of Oracle Database Server affecting versions 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. This vulnerability was discovered by Piotr Madej of ING Tech Poland and disclosed in Oracle's October 2020 Critical Patch Update (Oracle Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 2.8 (Confidentiality impacts) with the vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. This indicates a low severity vulnerability that requires local access and user interaction to exploit (NVD).

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of SQL Developer Install accessible data. The impact is limited to confidentiality with no effects on integrity or availability of the system (Oracle Advisory).

The vulnerability is considered easily exploitable but requires a low privileged attacker having Client Computer User Account privilege with logon to the infrastructure where SQL Developer Install executes. Additionally, successful exploitation requires human interaction from a person other than the attacker (NVD).

Oracle has released patches for this vulnerability as part of the October 2020 Critical Patch Update. Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible to address this vulnerability (Oracle Advisory).