Oracle Public Sector Financials International
Monthly
Full compromise (takeover) of the Oracle Public Sector Financials (International) module in Oracle E-Business Suite is possible via its Authorization component, affecting supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access over HTTP can, under difficult-to-exploit conditions, breach the module and, because of a scope change, significantly impact additional connected products. There is no public exploit identified at time of analysis and the issue is not on CISA KEV.
Authorization flaw in Oracle Public Sector Financials (International) versions 12.2.3 through 12.2.15 enables low-privileged authenticated attackers with HTTP network access to fully take over the affected component. Oracle's Critical Patch Update describes the issue as easily exploitable with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data access in Oracle Public Sector Financials (International), a module of Oracle E-Business Suite versions 12.2.6 through 12.2.15, allows low-privileged remote attackers to read sensitive data across module boundaries due to a flaw in the Authorization component. The scope-changed CVSS 7.7 vector indicates exploitation can affect resources beyond the vulnerable component itself, expanding the blast radius to other EBS data. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full compromise (takeover) of the Oracle Public Sector Financials (International) module in Oracle E-Business Suite is possible via its Authorization component, affecting supported versions 12.2.3 through 12.2.15. A high-privileged attacker with network access over HTTP can, under difficult-to-exploit conditions, breach the module and, because of a scope change, significantly impact additional connected products. There is no public exploit identified at time of analysis and the issue is not on CISA KEV.
Authorization flaw in Oracle Public Sector Financials (International) versions 12.2.3 through 12.2.15 enables low-privileged authenticated attackers with HTTP network access to fully take over the affected component. Oracle's Critical Patch Update describes the issue as easily exploitable with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data access in Oracle Public Sector Financials (International), a module of Oracle E-Business Suite versions 12.2.6 through 12.2.15, allows low-privileged remote attackers to read sensitive data across module boundaries due to a flaw in the Authorization component. The scope-changed CVSS 7.7 vector indicates exploitation can affect resources beyond the vulnerable component itself, expanding the blast radius to other EBS data. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.