Oracle Business Process Management Suite
Monthly
Cross-site scripting or improper access control in the Human Workflow component of Oracle Business Process Management Suite (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to read a subset of BPM data and perform unauthorized data modifications via HTTP, provided a legitimate user interacts with attacker-controlled content. The attack carries a scope change, meaning successful exploitation can impact components beyond the BPM Suite itself within the Oracle Fusion Middleware stack. No public exploit code has been identified and CISA has not listed this in KEV; EPSS places exploitation probability at 0.03% (8th percentile), consistent with low near-term exploitation risk.
Cross-site scripting or improper access control in the Human Workflow component of Oracle Business Process Management Suite (versions 12.2.1.4.0 and 14.1.2.0.0) allows unauthenticated remote attackers to read a subset of BPM data and perform unauthorized data modifications via HTTP, provided a legitimate user interacts with attacker-controlled content. The attack carries a scope change, meaning successful exploitation can impact components beyond the BPM Suite itself within the Oracle Fusion Middleware stack. No public exploit code has been identified and CISA has not listed this in KEV; EPSS places exploitation probability at 0.03% (8th percentile), consistent with low near-term exploitation risk.