An unauthenticated attacker with network access over HTTP can exploit a flaw in the Oracle Life Sciences InForm application server to perform privileged operations, allowing insert, update, or delete actions on data and read access to a subset of data. The resulting impact is a degradation of confidentiality and integrity, as reflected by the CVSS 3.1 base score of 6.5.

The affected products are Oracle Life Sciences InForm, version 7.0.1.0 and 7.0.1.1. The flaw resides in the App Server component of the Life Sciences InForm product suite.

The CVSS Base Score of 6.5 indicates a moderate threat, with Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, and User Interaction: None. Because the vulnerability is triggered by unauthenticated HTTP requests, any host with network access can exploit it without prior compromise. EPSS is not available and the vulnerability is not listed in CISA KEV, but the straightforward network exposure demands remediation to prevent potential data loss.