Low Privileged Access Vulnerability in Primavera P6 Enterprise Project Portfolio Management by Oracle
CVE-2021-2386

4.3MEDIUM

Key Information:

Vendor
Oracle
Status
Primavera P6 Enterprise Project Portfolio Management
Vendor
CVE Published:
20 July 2021

Summary

A vulnerability exists in the Primavera P6 Enterprise Project Portfolio Management software from Oracle, specifically within the Web Access component. This flaw allows a low privileged attacker with network access via HTTP to potentially gain unauthorized read access to certain data within the application. Affected versions are 20.12.0 through 20.12.3, which may expose sensitive information due to this security weakness.

Affected Version(s)

Primavera P6 Enterprise Project Portfolio Management 20.12.0-20.12.3

References

https://www.oracle.com/security-alerts/cpujul2021.html
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.