A flaw in the JD Edwards EnterpriseOne Tools installation security allows an unauthenticated attacker who has logged on to the infrastructure to potentially compromise the tools. The vulnerability is described as easily exploitable yet requires human interaction from a person other than the attacker, and successful exploitation can lead to a takeover of services. The impact spans confidentiality, integrity, and availability, as reflected in the CVSS 3.1 base score of 7.8.

Oracle Corporation’s JD Edwards EnterpriseOne Tools, specifically versions 9.2.0.0 through 9.2.26.5, are vulnerable to this issue.

The CVSS vector indicates a local attack (AV:L) with low complexity, no privileges required (PR:N) and user interaction needed (UI:R). Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, this local nature and the high confidentiality, integrity, and availability impact warrant concern. Based on the description, it is inferred that an attacker who has logged on to the infrastructure must influence a human operator to trigger the vulnerability; such an attacker could gain complete control over JD Edwards EnterpriseOne Tools.