Oracle Business Process Management Suite vulnerabilities

Vulnerability in Oracle Business Process Management Suite (Fabric Layer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can perform unauthorized modifications and gain access to critical data, and attacks may significantly impact additional products (scope change).

Vulnerability in Oracle Business Process Management Suite (Human Workflow (11g+) component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. Allows a low-privileged attacker with network access via SOAP to easily compromise and take over Oracle Business Process Management Suite, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.

Vulnerability in Oracle Business Process Management Suite (Human Workflow component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can take over the system.

Vulnerability in Oracle Business Process Management Suite (component: Human Workflow). Affected versions are 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via T3 or IIOP can compromise the system, potentially impacting other products.

Vulnerability in Oracle Business Process Management Suite (component Case management Service (11g+)) versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable attack via HTTP network access allows an unauthenticated attacker to gain unauthorized access to critical data and modify it.

Vulnerability in Oracle Business Process Management Suite (BPM Composer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with HTTP network access to take over the system.

Vulnerability in Oracle Business Process Management Suite (component: Human workflow 11g+) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the product with human interaction, resulting in unauthorized update, insert or delete access and unauthorized read access to a subset of data, with potential impact on additional products (scope change).