Oracle Configurator
Monthly
Cross-site scripting or improper access control in Oracle Configurator's User Interface component allows unauthenticated remote attackers to compromise data confidentiality and integrity across Oracle E-Business Suite. Affected versions span the full supported range of 12.2.3 through 12.2.15, requiring an authenticated victim to interact with attacker-controlled content to trigger the flaw. The scope change (S:C) signals that exploitation can pivot beyond Oracle Configurator itself into adjacent E-Business Suite products; no public exploit code has been identified and SSVC confirms exploitation status as none at time of analysis.
Cross-site scripting or improper access control in Oracle Configurator's User Interface component allows unauthenticated remote attackers to compromise data confidentiality and integrity across Oracle E-Business Suite. Affected versions span the full supported range of 12.2.3 through 12.2.15, requiring an authenticated victim to interact with attacker-controlled content to trigger the flaw. The scope change (S:C) signals that exploitation can pivot beyond Oracle Configurator itself into adjacent E-Business Suite products; no public exploit code has been identified and SSVC confirms exploitation status as none at time of analysis.