The Oracle Identity Manager Connector contains a vulnerability that allows an unauthenticated attacker with network connectivity to the HTTPS interface to compromise the system. An attacker can read all data exposed by the connector, resulting in a confidentiality breach. The CVSS 3.1 base score of 5.9 indicates a moderate impact, with no direct integrity or availability effects reported.

The affected product is Oracle’s Identity Manager Connector, version 12.2.1.4.0, part of Oracle Fusion Middleware Core. Only this specific release is listed as vulnerable, and no other versions were mentioned.

The risk is moderate, reflected in a CVSS score of 5.9, and the EPSS score is unavailable, so the quantitative likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack requires network access over HTTPS and no authentication. While exploitation is described as difficult, the potential for unauthorized data exposure exists, especially in environments where the connector is exposed to the public network.