Collectively called PAYDAY, the flaws were found by Onapsis Research Labs and patches were initially issued by Oracle in April 2018. Subsequent flaws were patched a year later.
However, at this stage, about 21,000 Oracle EBS customers are estimated to be at risk since the PAYDAY flaws exist in all versions of the software, Onapsis researcher Sebastian Bortnik said in a blog post.
"The severity... is evident from the significance of ERP systems such as Oracle to global business function; 77% of global revenue will pass through an ERP system at some point, of which Oracle’s 21,000 EBS customers are just a proportion," Bortnik said.
|
|
In a detailed report on the flaws, Onapsis said leaving them unaddressed could also mean that companies did not meet compliance standards required by different countries.
"From a Data Privacy standpoint (GDPR, CCPA, HIPAA, etc.), this vulnerability could allow an attacker to get personally identifiable information (PII) from the systems. This is the type of risk that usually makes executives and boards concerned about the possibility of a breach and a subsequent penalty if not properly addressed," the Onapsis report said.
Commenting on the vulnerabilities, Piyush Pandey, chief executive of ERP data security vendor Appsian, said: “Unfortunately, hackers are aware that traditional ERP systems lack the granular logging and analytics features required to detect unauthorised activity.
"Having a vulnerability that exploits a customer who may not be current on their security updates raises the risk of a data breach exponentially. Organisations must take additional steps to enhance their levels of visibility and control over their ERP data - and all of the user activity taking place around it."
Update, 25 November: Contacted for comment, Eric Maurice Oracle senior director, Global Product Security, said: “The security issues discussed in this paper have all been addressed in Oracle’s Critical Patch Update. Oracle encourages customers to follow the secure configuration recommendations in its deployment guides, remain on actively-supported versions, and apply Critical Patch Updates without delay.
"Unfortunately, Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches. In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches.
"At the time of the publication of this report, the most recent Critical Patch Update was the October 2019 Critical Patch Update."
