The vulnerability permits an attacker with low privileges and network access to the HTTP interface of Oracle Financial Services Analytical Applications Infrastructure to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unrestricted access to all data exposed by the infrastructure. The flaw results in confidentiality and integrity impacts, enabling attackers to alter or steal sensitive information.

Affected vendors and products include Oracle Corporation’s Oracle Financial Services Analytical Applications Infrastructure. Versions impacted are 8.0.7.9, 8.0.8.7, and 8.1.2.5. No other versions are mentioned.

The CVSS v3.1 score of 6.8 indicates a medium severity vulnerability that compromises confidentiality and integrity but not availability. The attack vector is network with HTTP, requiring low privileges. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Nonetheless, because the flaw permits widespread modification of critical data, a determined adversary could leverage this weakness, especially if network segmentation and access controls are lax. The typical exploitation path involves sending crafted requests over HTTP to the application with insufficient authorization checks, leading to unauthorized data operations.