CVE-2025-21526

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21526
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 20.12.1.0-20.12.21.5, 21.12.1.0-21.12.20.0, 22.12.1.0-22.12.16.0 and 23.12.1.0-23.12.10.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.oracle.com/security-alerts/cpujan2025.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
History

18 Jun 2025, 19:16

Type Values Removed Values Added
CPE cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
References () https://www.oracle.com/security-alerts/cpujan2025.html - () https://www.oracle.com/security-alerts/cpujan2025.html - Vendor Advisory
First Time Oracle primavera P6 Enterprise Project Portfolio Management
Oracle

04 Feb 2025, 16:15

Type Values Removed Values Added
CWE CWE-352
Summary
  • (es) Vulnerabilidad en el producto Primavera P6 Enterprise Project Portfolio Management de Oracle Construction and Engineering (componente: Web Access). Las versiones compatibles afectadas son 20.12.1.0-20.12.21.5, 21.12.1.0-21.12.20.0, 22.12.1.0-22.12.16.0 y 23.12.1.0-23.12.10.0. Esta vulnerabilidad, que se puede explotar fácilmente, permite que un atacante con pocos privilegios y acceso a la red a través de HTTP ponga en peligro Primavera P6 Enterprise Project Portfolio Management. Los ataques exitosos requieren la interacción humana de una persona distinta del atacante y, si bien la vulnerabilidad se encuentra en Primavera P6 Enterprise Project Portfolio Management, los ataques pueden afectar significativamente a otros productos (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden dar como resultado el acceso no autorizado a actualizaciones, inserciones o eliminaciones de algunos datos accesibles de Primavera P6 Enterprise Project Portfolio Management, así como el acceso no autorizado a un subconjunto de datos accesibles de Primavera P6 Enterprise Project Portfolio Management. Puntuación base CVSS 3.1: 5,4 (impactos en la confidencialidad y la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

21 Jan 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-21 21:15

Updated : 2025-06-18 19:16

NVD link : CVE-2025-21526

Mitre link : CVE-2025-21526

CVE.ORG link : CVE-2025-21526

JSON object : View

Products Affected

oracle

  • primavera_p6_enterprise_project_portfolio_management
CWE
CWE-352

Cross-Site Request Forgery (CSRF)