An unauthenticated attacker who can reach the Primavera Unifier web interface over HTTP can create, delete or modify data. The flaw allows the attacker to gain unauthorized access to critical data or complete control over all data accessible through the application. This represents a flaw in access control and permission checking. The weakness enables an attacker to compromise the confidentiality and integrity of the system.

Oracle Corporation’s Primavera Unifier Construction and Engineering product, version 21.12.0 through 21.12.17, is affected. Any installation of these versions is exploitable and could allow the vulnerabilities to be triggered via the Core component.

The CVSS 3.1 base score is 7.4, indicating high severity for confidentiality and integrity impacts. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP connection to the affected component, which an attacker can exploit without prior access.