Technical impact
An unauthenticated attacker with network access via HTTP can exploit a flaw in the Oracle Macaron Tool that causes the host address validation to fail. This failure can lead to a compromise of the tool, allowing the attacker to bypass address checks and potentially manipulate the service. The vulnerability does not explicitly claim remote code execution, but the ability to defeat validation rules may enable further exploitation or unauthorized configuration changes.
Affected Systems
Oracle Macaron Tool, part of Oracle Open Source Projects, version 0.22.0.
Risk and Exploitability
The CVSS score of 4.7 indicates a moderate level of risk. The EPSS score of 0.00021 (<1%) shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited widespread exploitation as yet. The attack vector is inferred to be network-based via HTTP, meaning any host exposed to the Internet or internal network could be at risk if the tool is not isolated or patched.
