CVE-2025-50061

July 16, 2025, 4:15 p.m.

5.4
Medium

Description

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 20.12.0-20.12.21, 21.12.0-21.12.21, 22.12.0-22.12.19, 23.12.0-23.12.13 and 24.12.0-24.12.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Product(s) Impacted

Vendor Product Versions
Oracle
  • Primavera P6 Enterprise Project Portfolio Management
  • 20.12.0-20.12.21, 21.12.0-21.12.21, 22.12.0-22.12.19, 23.12.0-23.12.13, 24.12.0-24.12.4

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-269
Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a oracle primavera_p6_enterprise_project_portfolio_management 20.12.0-20.12.21 / / / / / / /
a oracle primavera_p6_enterprise_project_portfolio_management 21.12.0-21.12.21 / / / / / / /
a oracle primavera_p6_enterprise_project_portfolio_management 22.12.0-22.12.19 / / / / / / /
a oracle primavera_p6_enterprise_project_portfolio_management 23.12.0-23.12.13 / / / / / / /
a oracle primavera_p6_enterprise_project_portfolio_management 24.12.0-24.12.4 / / / / / / /

References

https://www.oracle.com/security-alerts/cpujul2025.html

Tags

CWE-269
secalert_us@oracle.com
2025-07-15
CVE-2025-50061

CVSS Score

5.4 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: CHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: LOW
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

    View Vector String

Timeline

Published: July 15, 2025, 8:15 p.m.
Last Modified: July 16, 2025, 4:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert_us@oracle.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.