This flaw permits an unauthenticated attacker with network connectivity to send crafted HTTP requests to Oracle WebCenter Sites. Successful exploitation results in the attacker creating, deleting, or modifying critical data, and in some cases gaining unrestricted read access to all site data. The vulnerability directly compromises data confidentiality and integrity, but has no stated impact on availability.

The affected products are Oracle WebCenter Sites within Oracle Fusion Middleware. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected. The issue resides in the WebCenter Sites component.

The CVSS base score of 9.1 denotes a high severity vulnerability with a Network attack vector, low effort, no privileges or user interaction. The EPSS score of less than 1% indicates that, at the time of this analysis, exploitation is considered uncommon, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the flaw allows unauthenticated manipulation or disclosure of data over plain HTTP, it may remain attractive to threat actors. Exploitation requires only network visibility to the HTTP interface and does not require prior authentication.