A weakness in the Configuration Management component of JD Edwards EnterpriseOne Configurator allows an attacker with local or network access to the HTTP interface to create, delete, or modify critical data. The vulnerability is difficult to exploit but grants low privileged users the ability to alter data integrity without authentication. The impact is immediate and permanent modification of configuration data that can affect the entire application suite.

Oracle JD Edwards EnterpriseOne Configurator, version 9.2, which is the only supported version identified as affected. The application runs on the JD Edwards EnterpriseOne platform and is typical in enterprise ERP deployments.

The CVSS 3.1 base score of 5.3 reflects a moderate risk primarily for integrity. The exploitation vector is network-based via HTTP, with high effort required and low privileges needed. The EPSS score is not available, so exact exploitation likelihood is uncertain, but the vulnerability is listed as not in the KEV catalog, indicating no known widespread exploitation at this time. The risk remains significant for organizations relying on the configurator, particularly if the HTTP interface is exposed to untrusted networks.