Public Sector Human Resources
Monthly
Unauthorized data access and modification in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3-12.2.15) is achievable by a high-privileged remote attacker via HTTP, with exploitation triggering a scope change that can affect systems beyond the directly targeted component. The flaw resides in the Regression Testing component and carries CVSS 3.1 Base Score 7.7, reflecting high confidentiality and integrity impacts. No public exploit or CISA KEV active-exploitation listing has been identified at time of analysis.
Full system takeover in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged, network-capable attacker exploiting a flaw in the Regression Testing component over HTTP. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, with a scope change indicating that impact can cascade into adjacent Oracle EBS components beyond the directly affected module. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Unauthorized data access and modification in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3-12.2.15) is achievable by a high-privileged remote attacker via HTTP, with exploitation triggering a scope change that can affect systems beyond the directly targeted component. The flaw resides in the Regression Testing component and carries CVSS 3.1 Base Score 7.7, reflecting high confidentiality and integrity impacts. No public exploit or CISA KEV active-exploitation listing has been identified at time of analysis.
Full system takeover in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged, network-capable attacker exploiting a flaw in the Regression Testing component over HTTP. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, with a scope change indicating that impact can cascade into adjacent Oracle EBS components beyond the directly affected module. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.