Executive Summary

This vulnerability exists in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards, specifically in the Installation Security component. It affects supported versions 9.2.0.0 through 9.2.26.2. The vulnerability is easily exploitable by an unauthenticated attacker who has logon access to the infrastructure where JD Edwards EnterpriseOne Tools runs. Exploiting this vulnerability allows the attacker to compromise the JD Edwards EnterpriseOne Tools product.

Although the vulnerability is within JD Edwards EnterpriseOne Tools, successful attacks may also impact additional products due to a scope change. The attacker can potentially take over the JD Edwards EnterpriseOne Tools environment.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation of this vulnerability can lead to a complete takeover of the JD Edwards EnterpriseOne Tools product. This means an attacker could gain full control over the affected system.

The impact includes severe consequences to confidentiality, integrity, and availability of the system, as indicated by the CVSS 3.1 base score of 9.3 with high impacts on all three aspects.

Additionally, because the attack scope may extend beyond JD Edwards EnterpriseOne Tools, other related products and systems could also be compromised.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in JD Edwards EnterpriseOne Tools allows an unauthenticated attacker with logon access to compromise the product, potentially leading to a takeover. This results in high impacts on confidentiality, integrity, and availability of the system.

Such a compromise could lead to unauthorized access or modification of sensitive data, which may affect compliance with standards and regulations like GDPR and HIPAA that require protection of personal and health information.

However, the provided information does not explicitly describe the direct effects on compliance with these regulations.

Useful 0 Not Useful 0