Demand Planning
Monthly
Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attackers over HTTP to read all data accessible to the application and perform limited unauthorized write operations, with no authentication, elevated privileges, or user interaction required. Tagged as an authentication bypass by Oracle's own security team, this flaw carries a CVSS 3.1 base score of 8.2, reflecting high confidentiality and low integrity impact with no availability component. No public exploit code has been identified at the time of analysis, though the low attack complexity and complete absence of authentication barriers make this a straightforward target for automated or opportunistic exploitation once a proof-of-concept surfaces.
Privilege-leveraging compromise of Oracle Demand Planning (Internal Operations component) in Oracle Supply Chain / E-Business Suite versions 12.1 and 12.2 lets a low-privileged attacker with HTTP network access read and modify all data reachable by the module. Because the CVSS scope is Changed (S:C), successful attacks can extend impact beyond Demand Planning to additional connected products. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the 9.6 base score and low attack complexity make it a high-priority patch.
Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 12.1 and 12.2 allows remote attackers to affect confidentiality and integrity via vectors. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attackers over HTTP to read all data accessible to the application and perform limited unauthorized write operations, with no authentication, elevated privileges, or user interaction required. Tagged as an authentication bypass by Oracle's own security team, this flaw carries a CVSS 3.1 base score of 8.2, reflecting high confidentiality and low integrity impact with no availability component. No public exploit code has been identified at the time of analysis, though the low attack complexity and complete absence of authentication barriers make this a straightforward target for automated or opportunistic exploitation once a proof-of-concept surfaces.
Privilege-leveraging compromise of Oracle Demand Planning (Internal Operations component) in Oracle Supply Chain / E-Business Suite versions 12.1 and 12.2 lets a low-privileged attacker with HTTP network access read and modify all data reachable by the module. Because the CVSS scope is Changed (S:C), successful attacks can extend impact beyond Demand Planning to additional connected products. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the 9.6 base score and low attack complexity make it a high-priority patch.
Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 12.1 and 12.2 allows remote attackers to affect confidentiality and integrity via vectors. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.