Project Planning And Control
Monthly
Unauthorized data access and modification in Oracle Project Planning and Control (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated network attacker via HTTP, targeting the Change Management component. The vulnerability is tagged as an authentication bypass, suggesting an attacker with minimal credentials can exceed their authorized access level to read or manipulate critical project data without any user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle rates this as easily exploitable with a CVSS 8.1, making it a high-priority patching target in enterprise environments running E-Business Suite.
Unauthorized data access and modification in Oracle Project Planning and Control (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated network attacker via HTTP, targeting the Change Management component. The vulnerability is tagged as an authentication bypass, suggesting an attacker with minimal credentials can exceed their authorized access level to read or manipulate critical project data without any user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle rates this as easily exploitable with a CVSS 8.1, making it a high-priority patching target in enterprise environments running E-Business Suite.