Oracle WebCenter Content 14.1.2.0.0 is vulnerable to an unauthenticated HTTPS exploit that requires an attacker to socially engineer a second user into executing a crafted request. The flaw, identified as a web redirect weakness (CWE-601), lets the attacker gain unauthorized access to critical data, all data normally available within WebCenter Content, and allows insertion, updating, or deletion of records. The CVSS v3.1 baseline score of 8.2 reflects a high confidentiality impact, low integrity impact, and a scope change, indicating that the vulnerability can affect the overall system integrity beyond the direct target.

The affected product is Oracle WebCenter Content version 14.1.2.0.0, part of Oracle Fusion Middleware. The advisory notes that attacks originating against this product may also impact additional Oracle services hosted in the same environment.

The vulnerability is rated CVSS 8.2 with an EPSS score of less than 1%, indicating a low but non-zero chance of exploitation. It is not listed in the CISA KEV catalog. Exploitation occurs over HTTPS without authentication, with the primary barrier being the need for a human victim to interact with a malicious payload. Once the flaw is leveraged, the attacker can exercise unrestricted read or modify privileges on all WebCenter Content data. The potential for scope change amplifies the risk to other Oracle products within the same environment.