CVE-2013-5877: Oracle Demantra Demand Management unspecified confidentiality flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS 2.0 base score is 5.0 (medium) with only partial confidentiality impact, but the flaw is remotely reachable without authentication and EPSS is high, so it warrants prompt patching rather than emergency action.

What it is

CVE-2013-5877 is an unspecified vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite versions 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.0 and 12.2.1. Oracle's advisory and NVD provide no technical detail beyond 'DM Others', so the exact mechanism is unknown, but the flaw permits remote attackers to affect confidentiality. It matters because the affected component is reachable over the network without authentication, and the record gives no workaround beyond Oracle's January 2014 Critical Patch Update.

Impact

An attacker can read data the application exposes, limited to partial confidentiality impact; there is no integrity or availability impact in the CVSS vector. The specific data exposed is not described in the record.

Attack surface

Network-reachable (AV:N) with low attack complexity and no authentication required (AC:L/Au:N), per the CVSS 2.0 vector. No user interaction is indicated, and the record does not identify the exact endpoint or protocol.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, so there is no confirmed public exploitation. EPSS is high (0.54975, 98.978th percentile), indicating elevated predicted likelihood of exploitation activity, though the score is a model estimate rather than evidence of a working exploit.

What to do

• Apply the Oracle January 2014 Critical Patch Update (cpujan2014-1972949) or a later CPU that includes the fix for Demantra Demand Management.
• If patching cannot be done immediately, restrict network access to the Demantra Demand Management component to trusted hosts and users.
• Verify which listed versions (7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.0, 12.2.1) are deployed and prioritize internet-facing or broadly reachable instances.
• Monitor Oracle's advisory and successor CPUs for any updated guidance, since the original description lacks technical detail.

Detection

• Review Demantra Demand Management access logs for anomalous or unexpected read activity from unauthenticated or unfamiliar source addresses.
• Alert on scanning or enumeration attempts against the Demantra web endpoints, since the flaw is remotely reachable without credentials.
• Correlate outbound data volume from Demantra hosts against normal baselines to catch bulk data retrieval.
• Track Oracle CPU compliance for the affected Supply Chain Products Suite instances and flag unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.