Luke Turvey

This issue affects the Web Access component of Oracle Primavera P6 Enterprise Project Portfolio Management. A low-privileged attacker with network access via HTTP can compromise the application, requiring human interaction from a person other than the attacker. Successful exploitation may lead to unauthorized data modification, insertion, deletion, or read access. Attacks may potentially impact additional products.

The issue concerns a hardcoded password for the root account, which is set to `ifconfig`. This password cannot be changed through the configuration page, posing a security risk.

The issue allows for CSRF attacks, which can lead to changes in the AP name and password by modifying the settings binary.