Threats affecting pkg:maven/com.oracle.siebel/siebel-crm-end-user

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).

CVE-2026-70857 is a high-severity vulnerability in Oracle Siebel CRM End User (Open UI component) affecting versions 17.0 through 26.6. It allows a low privileged attacker with network access via HTTPS to compromise the Siebel CRM End User. Exploitation requires user interaction from a person other than the attacker and can lead to unauthorized creation, deletion, or modification of critical data across Siebel CRM products. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant confidentiality and integrity impacts with no availability impact.

CVE-2026-47032 is a vulnerability in Oracle Siebel CRM End User (Redwood UI component) affecting versions 24.4 through 26.3. It requires a high privileged attacker with network access via HTTP and involves user interaction from a third party. The vulnerability can lead to a partial denial of service (partial DOS) impacting Siebel CRM End User and potentially other products due to scope change. The CVSS 3.1 base score is 2.6, indicating a low severity primarily affecting availability.

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: User Interface). Supported versions that are affected are 25.0-25.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).