Security restrictions bypass in Primavera P6 Enterprise Project Portfolio Management - CVE-2019-2512

Vulnerability identifier: #VU17054

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-2512

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to insufficient input validation. A remote attacker can trick the victim into processing specially crafted input and bypass security restrictions to read and modify arbitrary system files.

Primavera P6 Enterprise Project Portfolio Management

Install update from vendor's website.

• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixEM

• Multiple vulnerabilities in Oracle Primavera
• Multiple vulnerabilities in Primavera P6 Enterprise Project Portfolio Management