Web Runtime Security Flaw in Oracle JD Edwards EnterpriseOne Tools

CVE-2022-21629

What is CVE-2022-21629?

A security vulnerability exists in Oracle JD Edwards EnterpriseOne Tools (specifically in the Web Runtime SEC component) that can be exploited by attackers with low privileges and network access via HTTP. This vulnerability, affecting versions 9.2.6.4 and prior, requires human interaction from a victim for successful execution. Exploiting this security flaw could lead to unauthorized access to data, including the ability to update, insert, or delete information within the JD Edwards EnterpriseOne system. While this vulnerability specifically impacts JD Edwards EnterpriseOne Tools, its effects may extend to additional connected products.

References