PT-2025-29324 · Oracle · Primavera P6 Enterprise Project Portfolio Management

Felipe Solferini + 1 · Published 2025-07-12 · Updated 2025-07-24 · CVE-2025-50061

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle Primavera P6 Enterprise Project Portfolio Management versions 20.12.0 through 20.12.21 Oracle Primavera P6 Enterprise Project Portfolio Management versions 21.12.0 through 21.12.21 Oracle Primavera P6 Enterprise Project Portfolio Management versions 22.12.0 through 22.12.19 Oracle Primavera P6 Enterprise Project Portfolio Management versions 23.12.0 through 23.12.13 Oracle Primavera P6 Enterprise Project Portfolio Management versions 24.12.0 through 24.12.4

Description This issue affects the Web Access component of Oracle Primavera P6 Enterprise Project Portfolio Management. A low-privileged attacker with network access via HTTP can compromise the application, requiring human interaction from a person other than the attacker. Successful exploitation may lead to unauthorized data modification, insertion, deletion, or read access. Attacks may potentially impact additional products.

Recommendations Update Oracle Primavera P6 Enterprise Project Portfolio Management to a version beyond 24.12.4. Update Oracle Primavera P6 Enterprise Project Portfolio Management to a version beyond 23.12.13. Update Oracle Primavera P6 Enterprise Project Portfolio Management to a version beyond 22.12.19. Update Oracle Primavera P6 Enterprise Project Portfolio Management to a version beyond 21.12.21. Update Oracle Primavera P6 Enterprise Project Portfolio Management to a version beyond 20.12.21.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-08636

CVE-2025-50061

Affected Products

Primavera P6 Enterprise Project Portfolio Management

References · 7

• https://osv.dev/vulnerability/CVE-2025-50061 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2025.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08636 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-50061 · Security Note
• https://twitter.com/CVEnew/status/1945207867721621635 · Twitter Post
• https://twitter.com/TurvSec/status/1943928954013864337 · Twitter Post
• https://twitter.com/dailycve/status/1948515688890474847 · Twitter Post