The vulnerability resides in the Oracle WebCenter Content component Content Server and allows an attacker with high privileged access and network connectivity via HTTP to create, delete, modify, and read data, as well as cause a partial denial of service. The impact extends to confidential, integral, and availability aspects of content data and may affect other Oracle products due to a scope change. The vulnerability is easily exploitable, only requiring the attacker to have high privilege credentials and to target the HTTP interface of the Content Server.

Affected systems include Oracle WebCenter Content from Oracle Corporation as part of the Oracle Fusion Middleware suite. The impacted releases are 12.2.1.4.0 and 14.1.2.0.0, both of which provide the Content Server component that is vulnerable.

The CVSS v3.1 base score of 8.2 indicates a high severity assessment. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is network-based HTTP access, and exploitation requires that the attacker already holds high-level privileges. Once exploited, the attacker can perform unauthorized modifications and a partial denial of service, posing a significant risk to data integrity and availability.