A flaw in the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process allows an attacker with low privileges and network access via HTTP to compromise the system. The vulnerability requires human interaction from a party other than the attacker, implying that the attacker must convince a legitimate user to take an action that facilitates exploitation. Successful exploitation can lead to unauthorized update, insert or delete operations on the system’s data, as well as unauthorized read access to a subset of that data, thereby impacting confidentiality and integrity of the application’s information.

Oracle Agile Product Lifecycle Management for Process, version 6.2.4, is the only supported version affected by this vulnerability.

The CVSS 3.1 base score of 5.4 indicates moderate severity with confidentiality and integrity impacts, while availability is unchanged. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is over HTTP, and the exploit requires a low privileged attacker with network access, but also human interaction, suggesting a moderate likelihood of successful exploitation in environments where such interactions can occur. The scope change indicates that successful attacks may extend to other products relying on the same component.