{"id":"CVE-2026-34324","state":"PUBLISHED","title":"Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server).  Supported versions that are affected are 7.0.1.0 and  7.0.1.1","description":"Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server).  Supported versions that are affected are 7.0.1.0 and  7.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as  unauthorized read access to a subset of Oracle Life Sciences InForm accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","publishedAt":"2026-04-21T20:35:42.273Z","updatedAt":"2026-04-22T15:34:32.777Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"oracle"},"assigner":"oracle","products":["Oracle Corporation Oracle Life Sciences InForm"],"affected":[{"vendor":"Oracle Corporation","product":"Oracle Life Sciences InForm","versions":[{"version":"7.0.1.0","status":"affected","versionType":"semver"},{"version":"7.0.1.1","status":"affected","versionType":"semver"}]}],"references":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/34xxx/CVE-2026-34324.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-34324","state":"PUBLISHED","datePublished":"2026-04-21T20:35:42.273Z","dateUpdated":"2026-04-22T15:34:32.777Z","assignerShortName":"oracle","assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","dateReserved":"2026-03-26T19:48:45.682Z"},"containers":{"cna":{"descriptions":[{"lang":"en-US","value":"Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server).  Supported versions that are affected are 7.0.1.0 and  7.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as  unauthorized read access to a subset of Oracle Life Sciences InForm accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)."}],"affected":[{"vendor":"Oracle Corporation","product":"Oracle Life Sciences InForm","versions":[{"version":"7.0.1.0","status":"affected","versionType":"semver"},{"version":"7.0.1.1","status":"affected","versionType":"semver"}]}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2026.html","name":"Oracle Advisory","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en-US","description":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences InForm.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Life Sciences InForm accessible data as well as  unauthorized read access to a subset of Oracle Life Sciences InForm accessible data."}]}],"providerMetadata":{"shortName":"oracle","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","dateUpdated":"2026-04-21T20:35:42.273Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:life_sciences_inform:7.0.1.0:*:*:*:*:*:*:*"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:life_sciences_inform:7.0.1.1:*:*:*:*:*:*:*"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-22T15:08:08.738831Z","id":"CVE-2026-34324","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-22T15:34:32.777Z"}}]}}}