Unauthorized Data Access in Oracle Primavera Unifier

CVE-2018-2965

What is CVE-2018-2965?

A significant vulnerability exists within the Primavera Unifier component of the Oracle Construction and Engineering Suite, specifically affecting the 16.x versions. This weakness allows an unauthenticated attacker with network access via HTTP to compromise the system. To exploit this vulnerability, an interaction from a user other than the attacker is necessary. While the primary target is Primavera Unifier, successful exploitation may influence other interconnected Oracle products. The attacks can lead to unauthorized capability to update, insert, or delete data, along with unauthorized reading of a portion of the accessible data within Primavera Unifier.

References