Oracle JD Edwards Web Runtime SEC Unauthenticated Data Access Vulnerability

A vulnerability exists in the JD Edwards EnterpriseOne Tools product, specifically in the Web Runtime SEC component. It affects versions 9.2.0.0 through 9.2.26.0. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Exploitation of this vulnerability requires human interaction from a third party. While the issue is contained within JD Edwards EnterpriseOne Tools, successful attacks could significantly impact additional products. The vulnerability allows unauthorized update, insert, or delete access to some accessible data within JD Edwards EnterpriseOne Tools, as well as unauthorized read access to a subset of the same data.

Impact

Exploitation of this vulnerability could lead to unauthorized access and modification of data within JD Edwards EnterpriseOne Tools, including the ability to read, update, insert, or delete certain accessible data. Additionally, according to Oracle, successful exploitation could allow for a scope change, impacting other products.