Unauthorized Access to Sensitive Data via HTTP

CVE-2024-21150

Summary

A significant vulnerability exists within the JD Edwards EnterpriseOne Tools product, specifically affecting the Web Runtime component. This issue allows an unauthenticated attacker with network access through HTTP to compromise the functionality of JD Edwards EnterpriseOne Tools. Successful exploitation requires human interaction from a third party, escalating the potential risk of unauthorized access. While the flaw is specifically within the JD Edwards EnterpriseOne Tools, the implications can extend to other intertwined products, suggesting a broader impact. The vulnerability can lead to unauthorized updates, inserts, or deletions of accessible data, as well as unauthorized reading of certain data sets, compromising both confidentiality and integrity of sensitive information.

References