Oracle Retail Xstore Point Of Service
Monthly
Unauthorized data disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows a network-based, low-privileged attacker to read a subset of application data via the Xstore Mobile component over HTTP. Tagged as an Authentication Bypass, the flaw suggests a low-privileged authenticated session can exceed its authorized data access scope without elevated rights. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate, bounded confidentiality risk.
Local privilege information disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows low-privileged users with system logon access to read a subset of Xstore data they are not authorized to view via the Xstore Mobile component. Despite carrying the 'Authentication Bypass' tag, the CVSS vector (AV:L/PR:L) confirms exploitation requires existing local infrastructure access - the bypass likely permits an authenticated low-privilege user to circumvent authorization controls and access restricted data segments. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unlikely in the near term.
Unauthorized data disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows a network-based, low-privileged attacker to read a subset of application data via the Xstore Mobile component over HTTP. Tagged as an Authentication Bypass, the flaw suggests a low-privileged authenticated session can exceed its authorized data access scope without elevated rights. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate, bounded confidentiality risk.
Local privilege information disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows low-privileged users with system logon access to read a subset of Xstore data they are not authorized to view via the Xstore Mobile component. Despite carrying the 'Authentication Bypass' tag, the CVSS vector (AV:L/PR:L) confirms exploitation requires existing local infrastructure access - the bypass likely permits an authenticated low-privilege user to circumvent authorization controls and access restricted data segments. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unlikely in the near term.