Oracle JD Edwards EnterpriseOne Tools Design Tools Security Vulnerability Allowing Unauthorized Data Access

A vulnerability exists in the JD Edwards EnterpriseOne Tools product, specifically within the Design Tools component, for versions prior to 9.2.9.0. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the affected tools. Exploitation of this vulnerability requires human interaction from a person other than the attacker. While the issue is contained within JD Edwards EnterpriseOne Tools, successful attacks could significantly impact additional products, leading to a scope change. The vulnerability allows unauthorized update, insert, or delete access to some accessible data within JD Edwards EnterpriseOne Tools, as well as unauthorized read access to a subset of that data.

Impact

Successful exploitation can result in unauthorized modifications or deletions of accessible data within JD Edwards EnterpriseOne Tools, along with unauthorized read access to certain data.

Remediation

Users are advised to update to JD Edwards EnterpriseOne Tools version 9.2.9.2 or later.