Summaryinfo

A vulnerability was found in Oracle Primavera P6 Enterprise Project Portfolio Management up to 19.12.22/20.12.20/21.12.17/22.12.10. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Web. This manipulation causes denial of service. This vulnerability appears as CVE-2023-5072. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Oracle Primavera P6 Enterprise Project Portfolio Management up to 19.12.22/20.12.20/21.12.17/22.12.10 (Project Management Software). It has been declared as critical. Affected by this vulnerability is an unknown code block of the component Web. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability.

The weakness was presented 01/16/2024 as Oracle Critical Patch Update Advisory - January 2024. The advisory is shared at oracle.com. This vulnerability is known as CVE-2023-5072. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 253225 (Linux Distros Unpatched Vulnerability : CVE-2023-5072), which helps to determine the existence of the flaw in a target environment.

A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (253225) and CERT Bund (WID-SEC-2025-1989). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• SAP Software

Productinfo

Type

• Project Management Software

Vendor

• Oracle

Name

• Primavera P6 Enterprise Project Portfolio Management

Version

• 19.12.0
• 19.12.1
• 19.12.2
• 19.12.3
• 19.12.4
• 19.12.5
• 19.12.6
• 19.12.7
• 19.12.8
• 19.12.9
• 19.12.10
• 19.12.11
• 19.12.12
• 19.12.13
• 19.12.14
• 19.12.15
• 19.12.16
• 19.12.17
• 19.12.18
• 19.12.19
• 19.12.20
• 19.12.21
• 19.12.22
• 20.12.0
• 20.12.1
• 20.12.2
• 20.12.3
• 20.12.4
• 20.12.5
• 20.12.6
• 20.12.7
• 20.12.8
• 20.12.9
• 20.12.10
• 20.12.11
• 20.12.12
• 20.12.13
• 20.12.14
• 20.12.15
• 20.12.16
• 20.12.17
• 20.12.18
• 20.12.19
• 20.12.20
• 21.12.0
• 21.12.1
• 21.12.2
• 21.12.3
• 21.12.4
• 21.12.5
• 21.12.6
• 21.12.7
• 21.12.8
• 21.12.9
• 21.12.10
• 21.12.11
• 21.12.12
• 21.12.13
• 21.12.14
• 21.12.15
• 21.12.16
• 21.12.17
• 22.12.0
• 22.12.1
• 22.12.2
• 22.12.3
• 22.12.4
• 22.12.5
• 22.12.6
• 22.12.7
• 22.12.8
• 22.12.9
• 22.12.10

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion