Project Manufacturing
Monthly
Unauthorized read access to a subset of project manufacturing data is possible via the PJM Command Center component in Oracle Project Manufacturing V16, exploitable over HTTP by a low-privileged authenticated network attacker. Despite the 'Authentication Bypass' tag from EUVD, the CVSS vector (PR:L) confirms valid credentials are required, indicating the bypass operates at the authorization layer within PJM Command Center rather than bypassing the EBS login mechanism entirely. Exploitation is significantly constrained by high attack complexity (AC:H), the confidentiality impact is limited (C:L), and no public exploit or active exploitation has been identified at time of analysis.
Oracle Project Manufacturing V16's PJM Command Center component exposes a low-severity local vulnerability requiring infrastructure-level access and high attack complexity. A low-privileged attacker with logon access to the host infrastructure can, under difficult exploitation conditions, perform unauthorized data modification or deletion against accessible Project Manufacturing records and induce a partial denial of service against the component. No public exploit code exists and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, placing practical risk well below the already-low CVSS score of 3.6 suggests.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component, part of Oracle E-Business Suite) permits a highly privileged, locally authenticated attacker to bypass access controls and gain unauthorized read access to all Oracle Project Manufacturing data as well as limited write access. The CVSS vector (AV:L/AC:H/PR:H) confirms this is neither remotely exploitable nor accessible to low-privileged users, substantially constraining real-world impact despite the High confidentiality impact rating. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component of Oracle E-Business Suite) enables a high-privileged attacker with local infrastructure access to achieve unauthorized read and write access to critical application data. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector explicitly requires high privileges (PR:H) and local access (AV:L), suggesting the bypass operates within application-layer authorization controls rather than at the authentication perimeter. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized read access to a subset of project manufacturing data is possible via the PJM Command Center component in Oracle Project Manufacturing V16, exploitable over HTTP by a low-privileged authenticated network attacker. Despite the 'Authentication Bypass' tag from EUVD, the CVSS vector (PR:L) confirms valid credentials are required, indicating the bypass operates at the authorization layer within PJM Command Center rather than bypassing the EBS login mechanism entirely. Exploitation is significantly constrained by high attack complexity (AC:H), the confidentiality impact is limited (C:L), and no public exploit or active exploitation has been identified at time of analysis.
Oracle Project Manufacturing V16's PJM Command Center component exposes a low-severity local vulnerability requiring infrastructure-level access and high attack complexity. A low-privileged attacker with logon access to the host infrastructure can, under difficult exploitation conditions, perform unauthorized data modification or deletion against accessible Project Manufacturing records and induce a partial denial of service against the component. No public exploit code exists and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, placing practical risk well below the already-low CVSS score of 3.6 suggests.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component, part of Oracle E-Business Suite) permits a highly privileged, locally authenticated attacker to bypass access controls and gain unauthorized read access to all Oracle Project Manufacturing data as well as limited write access. The CVSS vector (AV:L/AC:H/PR:H) confirms this is neither remotely exploitable nor accessible to low-privileged users, substantially constraining real-world impact despite the High confidentiality impact rating. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component of Oracle E-Business Suite) enables a high-privileged attacker with local infrastructure access to achieve unauthorized read and write access to critical application data. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector explicitly requires high privileges (PR:H) and local access (AV:L), suggesting the bypass operates within application-layer authorization controls rather than at the authentication perimeter. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.