Oracle Primavera P6 EPPM Web Access Vulnerability Allowing Unauthorized Data Access and Modification

A vulnerability has been identified in the Web Access component of Oracle Primavera P6 Enterprise Project Portfolio Management, affecting versions 20.12.1.0 through 20.12.21.5, 21.12.1.0 through 21.12.20.0, and 22.12.1.0. This vulnerability allows a low-privileged attacker with network access via HTTP to compromise Primavera P6 EPPM. Exploitation requires human interaction from a third party. While the vulnerability is specific to Primavera P6 EPPM, successful attacks could significantly impact other products, leading to a scope change. Exploitation of this vulnerability could result in unauthorized read access to certain Primavera P6 EPPM data, as well as unauthorized update, insert, or delete access to some accessible data.

Impact

Exploitation of this vulnerability could lead to unauthorized read access to a subset of Primavera P6 EPPM data, as well as unauthorized modification of some accessible data, allowing for unauthorized updates, inserts, or deletions.