Oracle JD Edwards Web Runtime SEC Unauthenticated Data Access Vulnerability

A vulnerability exists in the JD Edwards EnterpriseOne Tools product, specifically in the Web Runtime SEC component, prior to version 9.2.9.2. This easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful exploitation requires human interaction from a third party. While the vulnerability is contained within JD Edwards EnterpriseOne Tools, its effects may extend to other products, leading to a scope change. Exploitation of this vulnerability could result in unauthorized read access to certain JD Edwards EnterpriseOne Tools data, as well as unauthorized update, insert, or delete access to other accessible data.

Impact

Exploitation allows for unauthorized data access, including the ability to read, update, insert, or delete certain JD Edwards EnterpriseOne Tools data.