Order Management Enterprise Command Center
Monthly
Oracle Order Management, a module of Oracle E-Business Suite, contains a flaw in its Enterprise Command Center component affecting the supported version V16, allowing a low-privileged attacker with network access over HTTP to read all Order Management data the attacked account can reach and to modify part of it. Oracle rates this 7.1 with confidentiality fully impacted and integrity partially impacted, and the vendor describes it as easily exploitable, though authentication with at least a low-privileged account is required per the CVSS vector (PR:L). At the time of analysis there is no public exploit code or CISA KEV listing, and no EPSS score was supplied, so risk is driven by the criticality of the ERP data rather than by evidence of active exploitation.
Authenticated low-privileged users with network HTTP access can fully compromise Order Management data in Oracle E-Business Suite 12.2.4 through 12.2.15, gaining unauthorized read, creation, deletion, and modification of any Order Management data reachable through the Product Diagnostic Tools component. Rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the issue needs only a valid low-privileged account, no user interaction, and no elevated privileges, so any authenticated foothold on the instance is enough; there is no availability impact and no scope change. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though no EPSS score was provided in the source data.
Oracle Order Management, a module of Oracle E-Business Suite, contains a flaw in its Enterprise Command Center component affecting the supported version V16, allowing a low-privileged attacker with network access over HTTP to read all Order Management data the attacked account can reach and to modify part of it. Oracle rates this 7.1 with confidentiality fully impacted and integrity partially impacted, and the vendor describes it as easily exploitable, though authentication with at least a low-privileged account is required per the CVSS vector (PR:L). At the time of analysis there is no public exploit code or CISA KEV listing, and no EPSS score was supplied, so risk is driven by the criticality of the ERP data rather than by evidence of active exploitation.
Authenticated low-privileged users with network HTTP access can fully compromise Order Management data in Oracle E-Business Suite 12.2.4 through 12.2.15, gaining unauthorized read, creation, deletion, and modification of any Order Management data reachable through the Product Diagnostic Tools component. Rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the issue needs only a valid low-privileged account, no user interaction, and no elevated privileges, so any authenticated foothold on the instance is enough; there is no availability impact and no scope change. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though no EPSS score was provided in the source data.