Oracle JD Edwards Web Runtime SEC Unauthenticated Data Access Vulnerability

A vulnerability exists in the JD Edwards EnterpriseOne Tools product, specifically in the Web Runtime SEC component, affecting versions prior to 9.2.9.0. This easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful exploitation requires human interaction from a third party. While the vulnerability is contained within JD Edwards EnterpriseOne Tools, it may significantly impact additional products. Exploitation of this vulnerability could lead to unauthorized read access to certain JD Edwards EnterpriseOne Tools data, as well as unauthorized update, insert, or delete access to other accessible data.

Impact

Exploitation allows for unauthorized read access to some JD Edwards EnterpriseOne Tools data, and unauthorized update, insert, or delete access to other accessible data.