Vulnerability in JD Edwards EnterpriseOne Tools by Oracle

CVE-2023-21936

What is CVE-2023-21936?

A vulnerability exists in Oracle's JD Edwards EnterpriseOne Tools, specifically within the Web Runtime SEC component, affecting versions prior to 9.2.7.3. This flaw allows a low privileged attacker with network access via HTTP to exploit the system. Successful exploitation hinges on human interaction from someone other than the attacker. Although the vulnerability resides in JD Edwards EnterpriseOne Tools, it may have wider implications, potentially affecting other products as well. Consequences of this vulnerability include unauthorized updates, inserts, or deletions of accessible data, in addition to unauthorized read access to certain datasets.

References