Authentication Bypass in JD Edwards EnterpriseOne Order Promising

Executive Summary

This vulnerability exists in the JD Edwards EnterpriseOne Order Promising product of Oracle JD Edwards, specifically in the Order Promising Integration component. It affects version 9.2 and can be exploited by a low privileged attacker who has network access via HTTP. The vulnerability allows the attacker to compromise the Order Promising product, potentially leading to a takeover of the system.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation of this vulnerability can result in a complete takeover of the JD Edwards EnterpriseOne Order Promising system. This can have significant impacts on confidentiality, integrity, and availability of the affected system and potentially other related products due to scope change. The CVSS score of 9.9 indicates a critical severity level.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a low privileged attacker with network access to compromise JD Edwards EnterpriseOne Order Promising, potentially resulting in a complete takeover of the product. Given the high CVSS score (9.9) with impacts on confidentiality, integrity, and availability, this could lead to unauthorized access to sensitive data or disruption of services.

Such a compromise could negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive personal and health information, ensuring data confidentiality, integrity, and availability.

However, the provided information does not explicitly mention compliance impacts or specific regulatory considerations.

Useful 0 Not Useful 0