Transportation Execution
Monthly
Oracle Transportation Execution (E-Business Suite versions 12.2.3 through 12.2.15) exposes a network-exploitable integrity flaw in its Internal Operations component that allows a low-privileged authenticated attacker to gain unauthorized create, delete, and modify access to critical data - including a partial confidentiality breach - with a scope change impacting additional Oracle EBS products. The attack requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern (e.g., stored XSS or similar), amplified by the 'Authentication Bypass' tag suggesting privilege escalation from low to higher access tiers. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Install and Upgrade). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Oracle Transportation Execution (E-Business Suite versions 12.2.3 through 12.2.15) exposes a network-exploitable integrity flaw in its Internal Operations component that allows a low-privileged authenticated attacker to gain unauthorized create, delete, and modify access to critical data - including a partial confidentiality breach - with a scope change impacting additional Oracle EBS products. The attack requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern (e.g., stored XSS or similar), amplified by the 'Authentication Bypass' tag suggesting privilege escalation from low to higher access tiers. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Install and Upgrade). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.