This vulnerability in Oracle Email Center allows an unauthenticated attacker who reaches the application over HTTP to obtain unauthorized read and write access to data. The flaw is triggered by user interaction that is not controlled by the attacker, meaning the attacker must convince another individual to conduct further actions to fully exploit the weakness. The weakness falls under improper access control, permitting unauthorized update, insert, delete, or read operations on Email Center data, thus impacting confidentiality and integrity.

Oracle Corporation’s Oracle Email Center versions 12.2.3 through 12.2.15 are affected. These versions of the Message Component allow the described unauthorized access if an unauthenticated user can reach the component via HTTP.

The CVSS v3.1 base score of 6.1 classifies the vulnerability as medium severity, with a Network attack vector, low effort, no privileges, and user interaction required. The EPSS score is not available, making it difficult to gauge current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the Email Center and a willing user to provide interaction, after which they could modify or read data, affecting confidentiality and integrity of the system.