Oracle Performance Management
Monthly
Unauthorized data access and modification in Oracle Performance Management (E-Business Suite Appraisals component, versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user with HTTP network access. The flaw enables partial reads of restricted appraisal data and unauthorized insert, update, or delete operations within the accessible data scope - an insider threat or compromised low-privilege account scenario. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing real-world urgency at moderate levels for enterprises running Oracle E-Business Suite with the Performance Management module active.
Unauthorized data access and modification in Oracle Performance Management (E-Business Suite Appraisals component, versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user with HTTP network access. The flaw enables partial reads of restricted appraisal data and unauthorized insert, update, or delete operations within the accessible data scope - an insider threat or compromised low-privilege account scenario. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing real-world urgency at moderate levels for enterprises running Oracle E-Business Suite with the Performance Management module active.