Oracle Identity Manager Connector, part of Oracle Fusion Middleware, contains a flaw that permits unauthenticated HTTP requests to retrieve sensitive information. Successful exploitation enables an attacker to read all data exposed by the connector, resulting in a confidentiality compromise. The weakness is characterized as Improper Authentication (CWE-306) that leads to Information Exposure and is reflected in a CVSS 3.1 base score of 5.9 with impacts limited to confidentiality.

Oracle Identity Manager Connector version 12.2.1.4.0 is affected. No other versions or products have been identified as impacted at this time.

The CVSS score of 5.9 ranks the vulnerability as moderate, with the exploit description noting that it is difficult to execute and the EPSS score of <1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread attacks have been reported. The likely attack vector involves an unauthenticated attacker sending HTTP requests from a network that can reach the connector. Successful use of the vulnerability results in unauthorized access to all data that the connector exposes.