Mes For Process Manufacturing
Monthly
Unauthorized data disclosure in Oracle MES for Process Manufacturing (versions 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to bypass internal authorization controls and gain complete access to all data accessible by the MES component. The scope change (S:C in CVSS) means successful exploitation can cascade into other Oracle E-Business Suite products, amplifying the confidentiality impact beyond the MES module itself. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; however, the 'Authentication Bypass' tag, low attack complexity, and no required user interaction make this a credible risk in exposed enterprise EBS deployments.
Oracle MES for Process Manufacturing versions 12.2.3 through 12.2.15 exposes unauthenticated remote attackers to complete confidentiality compromise and partial integrity loss via HTTP, contingent on a victim's interaction. The scope change in the CVSS vector confirms that a successful attack can cascade beyond the MES module itself into additional Oracle E-Business Suite components. No public exploit code or CISA KEV active-exploitation confirmation exists at time of analysis, but the low attack complexity and zero privilege requirement make this a credible phishing or watering-hole vector against manufacturing-sector targets.
Unauthorized data disclosure in Oracle MES for Process Manufacturing (versions 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to bypass internal authorization controls and gain complete access to all data accessible by the MES component. The scope change (S:C in CVSS) means successful exploitation can cascade into other Oracle E-Business Suite products, amplifying the confidentiality impact beyond the MES module itself. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; however, the 'Authentication Bypass' tag, low attack complexity, and no required user interaction make this a credible risk in exposed enterprise EBS deployments.
Oracle MES for Process Manufacturing versions 12.2.3 through 12.2.15 exposes unauthenticated remote attackers to complete confidentiality compromise and partial integrity loss via HTTP, contingent on a victim's interaction. The scope change in the CVSS vector confirms that a successful attack can cascade beyond the MES module itself into additional Oracle E-Business Suite components. No public exploit code or CISA KEV active-exploitation confirmation exists at time of analysis, but the low attack complexity and zero privilege requirement make this a credible phishing or watering-hole vector against manufacturing-sector targets.