PT-2025-4250 · Oracle · Primavera P6 Enterprise Project Portfolio Management

Published

2025-01-21

·

Updated

2025-06-18

·

CVE-2025-21528

CVSS v2.0

6.4

Medium

VectorAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions Primavera P6 Enterprise Project Portfolio Management versions 20.12.1.0 through 20.12.21.5 Primavera P6 Enterprise Project Portfolio Management versions 21.12.1.0 through 21.12.20.0 Primavera P6 Enterprise Project Portfolio Management versions 22.12.1.0 through 22.12.16.0 Primavera P6 Enterprise Project Portfolio Management versions 23.12.1.0 through 23.12.10.0
Description The issue allows an unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker, and can result in unauthorized update, insert, or delete access to some of the accessible data.
Recommendations For versions 20.12.1.0 through 20.12.21.5, update to a version outside of this range to mitigate the risk. For versions 21.12.1.0 through 21.12.20.0, update to a version outside of this range to mitigate the risk. For versions 22.12.1.0 through 22.12.16.0, update to a version outside of this range to mitigate the risk. For versions 23.12.1.0 through 23.12.10.0, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Web Access component until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2025-06664
CVE-2025-21528

Affected Products

Primavera P6 Enterprise Project Portfolio Management