JD Edwards EnterpriseOne Tools Remote Code Execution

Compliance Impact

This vulnerability allows an unauthenticated attacker with network access to fully compromise the JD Edwards EnterpriseOne Tools, resulting in complete confidentiality, integrity, and availability impacts.

Such a compromise could lead to unauthorized access to sensitive data, data manipulation, and service disruption, which may violate requirements of common standards and regulations like GDPR and HIPAA that mandate protection of personal and sensitive information.

Therefore, organizations using affected versions of JD Edwards EnterpriseOne Tools may face increased risk of non-compliance with these regulations if this vulnerability is exploited.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards, specifically in the Enterprise Infrastructure Security component. It affects supported versions 9.2.0.0 through 9.2.26.2. The vulnerability is easily exploitable by an unauthenticated attacker who has network access via JDENET, allowing them to compromise the JD Edwards EnterpriseOne Tools.

A successful attack can lead to a complete takeover of the JD Edwards EnterpriseOne Tools system.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is severe, with a CVSS 3.1 base score of 9.8 indicating critical severity. It affects confidentiality, integrity, and availability, meaning an attacker can gain unauthorized access to sensitive information, alter data, and disrupt system operations.

Specifically, a successful exploit can result in the attacker taking full control over the JD Edwards EnterpriseOne Tools, potentially leading to data breaches, data manipulation, and denial of service.

Useful 0 Not Useful 0