Compliance Impact

The vulnerability allows unauthorized read, update, insert, or delete access to some data within Oracle Life Sciences InForm, as well as the ability to cause a partial denial of service. Such unauthorized access and potential data manipulation could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.

Specifically, unauthorized access to sensitive data may violate confidentiality requirements, while unauthorized modifications could impact data integrity. Additionally, denial of service could affect availability obligations under these standards.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Oracle Life Sciences InForm product, specifically in the IDM Authentication component for versions 7.0.1.0 and 7.0.1.1.

It allows an unauthenticated attacker with network access via HTTP to compromise the system. However, successful exploitation requires human interaction from someone other than the attacker.

If exploited, the attacker can gain unauthorized abilities such as updating, inserting, or deleting some accessible data, reading a subset of accessible data, and causing a partial denial of service (partial DOS) on the Oracle Life Sciences InForm system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to perform unauthorized actions on your Oracle Life Sciences InForm data.

• Unauthorized update, insert, or delete access to some accessible data.
• Unauthorized read access to a subset of accessible data.
• Ability to cause a partial denial of service (partial DOS) affecting availability of the system.

Useful 0 Not Useful 0