A flaw in the Portlet Services component of Oracle WebCenter Portal permits a low‑privileged attacker who has network access to HTTP services to gain unauthorized access to critical data. The vulnerability is easily exploitable and results in a significant confidentiality impact while the integrity and availability remain unaffected. Because the CVSS vector indicates a scope change, the exploitation may allow access to all data that the portal can provide, effectively escalating the attacker’s privileges within the system.

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable. These releases are part of Oracle Fusion Middleware’s WebCenter Portal suite.

The CVSS score of 7.7 reflects a high severity due to the ease of exploitation and the confidentiality impact. The EPSS score of less than 1% suggests that, as of the last assessment, the probability of exploitation in the wild is low, but the vulnerability is not listed in CISA’s KEV catalog. The likely attack path is via network‑based HTTP traffic from an attacker with low privileges, where the flaw is triggered by a specific request to the Portlet Services endpoint. Because the vector includes a scope change, successful exploitation would allow the attacker to access data beyond the original privilege level.