CVE-2020-2956

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Human Resources versions 12.1.1 through 12.1.3 Oracle E-Business Suite Human Resources versions 12.2.3 through 12.2.9

Description The issue is related to inadequate access control in the Hierarchy Diagrammers component of Oracle Human Resources, allowing a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as complete access to all accessible data. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions 12.1.1 through 12.1.3, update to a version outside of this range to mitigate the risk. For versions 12.2.3 through 12.2.9, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Hierarchy Diagrammers component until a patch is available.