Service Contracts
Monthly
Oracle Service Contracts in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in its Internal Operations component reachable over HTTP without credentials, enabling unauthorized full read and write access to critical service contract data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact, moderated by high attack complexity (AC:H) that prevents trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature of the flaw and the sensitivity of contract data make this a meaningful target for motivated adversaries with access to the EBS application layer.
Oracle Service Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes a network-accessible integrity and confidentiality flaw in its Internal Operations component that allows a high-privileged, authenticated attacker to bypass authorization controls and gain unauthorized read or write access to all Service Contracts data. The attack is rated difficult to exploit and requires human interaction from a third party, substantially limiting opportunistic exploitation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the 'Authentication Bypass' tag signals a meaningful authorization control gap rather than a simple privilege escalation.
Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Service Contracts component of Oracle E-Business Suite (subcomponent: Renewals). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unspecified vulnerability in the Oracle Service Contracts component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Oracle Service Contracts in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in its Internal Operations component reachable over HTTP without credentials, enabling unauthorized full read and write access to critical service contract data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact, moderated by high attack complexity (AC:H) that prevents trivial mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature of the flaw and the sensitivity of contract data make this a meaningful target for motivated adversaries with access to the EBS application layer.
Oracle Service Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes a network-accessible integrity and confidentiality flaw in its Internal Operations component that allows a high-privileged, authenticated attacker to bypass authorization controls and gain unauthorized read or write access to all Service Contracts data. The attack is rated difficult to exploit and requires human interaction from a third party, substantially limiting opportunistic exploitation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the 'Authentication Bypass' tag signals a meaningful authorization control gap rather than a simple privilege escalation.
Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Service Contracts component of Oracle E-Business Suite (subcomponent: Renewals). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unspecified vulnerability in the Oracle Service Contracts component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.