Unauthenticated Access Vulnerability in Oracle Primavera P6 Enterprise Project Portfolio Management

CVE-2019-3020

Summary

A significant vulnerability exists in Oracle's Primavera P6 Enterprise Project Portfolio Management, specifically in the web access component. The flaw allows an unauthenticated attacker with network access through HTTP to compromise the system. While successfully exploiting this vulnerability necessitates human interaction from someone other than the attacker, it poses a severe risk as it can lead to unauthorized creation, deletion, or modification of critical data. Moreover, successful exploitation can grant the attacker unauthorized access to a broad range of Primavera P6 data, which may also impact other interconnected Oracle products.

References