Oracle's Agile Product Lifecycle Management for Process version 6.2.4 contains a flaw that allows an attacker who can reach the system over HTTP to gain unauthorized read access to critical data and, in some cases, to modify or delete that data. The attack does not require any authentication and can be carried out from any network location that can reach the HTTP endpoint. The flaw results in a high confidentiality impact, a low integrity impact, and no availability impact.

Oracle Corporation. Product: Oracle Agile Product Lifecycle Management for Process. Affected version: 6.2.4.

The CVSS v3.1 base score of 8.2 indicates a high severity vulnerability. The EPSS score is < 1%, indicating a very low probability of exploitation, yet the description emphasizes that the flaw is easily exploitable by an unauthenticated network user. The vulnerability is not listed in the CISA KEV catalog, but an attacker could achieve full unauthorized access to all data exposed by the application. The likely attack vector is a direct HTTP request to the vulnerable component, without needing any special credentials.