CVE-2013-5880: Oracle Demantra Demand Management unspecified confidentiality flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: low.

medium priorityThe flaw is remotely reachable without authentication and has a very high EPSS score, but it is only a partial confidentiality impact, has no confirmed exploitation, and the affected product is a niche supply chain module.

What it is

CVE-2013-5880 is an unspecified vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite 12.2.0, 12.2.1 and 12.2.2. It allows remote attackers to affect confidentiality via unknown vectors related to DM Others, and the record gives no detail on the underlying weakness. Because the flaw is undocumented, defenders cannot reason about the exact mechanism and must rely on the vendor patch.

Impact

An attacker can read data the application would otherwise protect, affecting confidentiality only. No integrity or availability impact is described in the CVSS vector.

Attack surface

The CVSS vector AV:N/AC:L/Au:N/C:P/I:N/A:N indicates the flaw is reachable over the network with no authentication and no user interaction. The specific interface or endpoint within DM Others is not described.

Exploitation

The record is not listed in CISA KEV and no reference carries an exploit tag, so there is no confirmed in-the-wild exploitation. EPSS is high (0.59558, 99th percentile), suggesting elevated likelihood of attempted exploitation, but this is a model estimate, not evidence of active attacks.

What to do

• Apply the Oracle Critical Patch Update for January 2014, which addresses this issue, to Demantra Demand Management 12.2.0, 12.2.1 and 12.2.2.
• If patching cannot be done immediately, restrict network access to the Demantra Demand Management component to trusted hosts and users.
• Place the application behind authentication-aware proxies or VPN access so unauthenticated internet clients cannot reach it.
• Monitor Oracle's advisory and successor CPU notices for any updated guidance or revised affected versions.
• Review database and application logs for unexpected read activity against Demantra data.

Detection

• Review web and application logs for anomalous or unexpected requests to Demantra Demand Management endpoints from unauthenticated or unfamiliar sources.
• Baseline normal query and data-access patterns for Demantra users and alert on large or unusual reads of demand management data.
• Monitor network traffic to the Demantra service for scanning or probing consistent with attempts to reach the DM Others vectors.
• Track EPSS and KEV status for this CVE and escalate monitoring if exploitation evidence appears.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.