Compliance Impact

The vulnerability allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to critical or all accessible data within JD Edwards EnterpriseOne Project Costing. Such unauthorized access and data manipulation can lead to violations of data protection and privacy regulations like GDPR and HIPAA, which require strict controls over data confidentiality and integrity.

Because the vulnerability impacts confidentiality and integrity with a high CVSS score (9.6), it poses a significant risk to compliance with standards that mandate protection of sensitive data, potentially resulting in regulatory non-compliance and associated penalties.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the JD Edwards EnterpriseOne Project Costing product of Oracle JD Edwards, specifically in the Job Costing component. It affects version 9.2 and can be exploited by a low privileged attacker who has network access via JDENET.

The vulnerability allows the attacker to compromise the Project Costing system, potentially impacting additional related products. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, or unauthorized access to all data accessible by JD Edwards EnterpriseOne Project Costing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to critical data and unauthorized modification or deletion of important information within the JD Edwards EnterpriseOne Project Costing system.

Because the scope of the attack can extend beyond just the Project Costing product, it may affect additional related products, increasing the risk and potential damage.

The high CVSS score of 9.6 indicates a critical severity, emphasizing the potential for significant confidentiality and integrity breaches.

Useful 0 Not Useful 0