Mobile Application Server
Monthly
Unauthorized data disclosure in Oracle Mobile Application Server's MWA Terminal Server component affects all supported E-Business Suite deployments running versions 12.2.3 through 12.2.15. Low-privileged network attackers with HTTP access can exploit an authorization bypass to gain complete read access to all data within the Mobile Application Server's scope - including sensitive warehouse, inventory, and business records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog, but Oracle's advisory language explicitly flags it as 'easily exploitable,' reducing the practical barrier significantly.
Unauthorized data access and denial of service in Oracle Mobile Application Server's MWA Terminal Server component (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a high-privileged attacker over HTTP. Successful exploitation grants complete read access to all data accessible by the Mobile Application Server, limited write capability (insert/update/delete on some data), and the ability to cause a complete, repeatable denial-of-service crash. The 'Authentication Bypass' tag in the intelligence data conflicts with the PR:H CVSS metric, suggesting the flaw may allow an authenticated administrator to bypass authorization controls beyond their intended access scope. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized data disclosure in Oracle Mobile Application Server's MWA Terminal Server component affects all supported E-Business Suite deployments running versions 12.2.3 through 12.2.15. Low-privileged network attackers with HTTP access can exploit an authorization bypass to gain complete read access to all data within the Mobile Application Server's scope - including sensitive warehouse, inventory, and business records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog, but Oracle's advisory language explicitly flags it as 'easily exploitable,' reducing the practical barrier significantly.
Unauthorized data access and denial of service in Oracle Mobile Application Server's MWA Terminal Server component (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a high-privileged attacker over HTTP. Successful exploitation grants complete read access to all data accessible by the Mobile Application Server, limited write capability (insert/update/delete on some data), and the ability to cause a complete, repeatable denial-of-service crash. The 'Authentication Bypass' tag in the intelligence data conflicts with the PR:H CVSS metric, suggesting the flaw may allow an authenticated administrator to bypass authorization controls beyond their intended access scope. No public exploit or CISA KEV listing has been identified at time of analysis.