Vulnerability in the Engineering Communication Interface of Oracle Agile Engineering Data Management exposes an unauthenticated attacker with network access via HTTP the ability to update, insert, or delete authorized data and to read certain sensitive data. The flaw allows manipulation of data integrity and unauthorized disclosure of confidential information, classifying it as a moderate severity issue with a CVSS 3.1 Base Score of 4.8. The CWEs relevant include Improper Access Control (CWE-284) and Sensitive Data Exposure (CWE-200). The description does not provide details on the precise exploitation technique, but the lack of required authentication combined with network exposure implies direct exploitation through crafted HTTP requests.

Oracle Corporation’s Oracle Agile Engineering Data Management component (Engineering Communication Interface) version 6.2.1, part of the Oracle Supply Chain Management suite.

The CVSS score indicates moderate risk. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited evidence of active exploitation. The likely attack vector is network-based via HTTP without authentication. An attacker who succeeds can alter or delete data and read restricted information, potentially compromising confidentiality and integrity of the affected database. The exploit requires only network access and no privileged credentials, increasing the realistic threat to any system exposed to external or untrusted networks.