Oracle Human Resources
Monthly
Full compromise of Oracle Human Resources (part of Oracle E-Business Suite) is possible via the Data Removal Tool component, where a high-privileged attacker with HTTP network access can take over the module across supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, and Oracle classifies it as easily exploitable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Takeover of Oracle Human Resources in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible when a remote unauthenticated attacker tricks a separate user into interacting with a crafted HTTP request targeting the Person component. Despite high attack complexity, successful exploitation yields full confidentiality, integrity, and availability impact on the HR module. No public exploit identified at time of analysis.
Full compromise of Oracle Human Resources (part of Oracle E-Business Suite) is possible via the Data Removal Tool component, where a high-privileged attacker with HTTP network access can take over the module across supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, and Oracle classifies it as easily exploitable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Takeover of Oracle Human Resources in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible when a remote unauthenticated attacker tricks a separate user into interacting with a crafted HTTP request targeting the Person component. Despite high attack complexity, successful exploitation yields full confidentiality, integrity, and availability impact on the HR module. No public exploit identified at time of analysis.