The vulnerability is located in the Security Framework component of Oracle Enterprise Manager Base Platform. It permits an unauthenticated attacker with network access to HTTP to update, insert, or delete data, read protected data, or trigger a partial denial of service. These capabilities reflect failures of proper authorization controls and a denial-of-service weakness (CWE-400), compromising confidentiality, integrity, and availability of the platform.

Oracle Enterprise Manager Base Platform version 13.5 and version 24.1 are affected. The vulnerability is present in both releases of the product.

The CVSS base score is 5.6, indicating moderate risk, with an attack vector that is network and requires no prior authentication but high complexity. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attacker must be able to reach the target over HTTP, but the lack of authentication makes the threat global for systems exposed to the Internet. The vulnerability also includes a denial-of-service weakness (CWE-400), which could lead to partial disruption of the platform. Despite the moderate score, the ability to alter data and cause denial of service calls for prompt action.