The flaw exists in the Content Server component of Oracle WebCenter Content and permits an unauthenticated attacker who can reach the server over HTTP to gain read access to protected data. A separate, non‑authorized user must interact with the system—often through social engineering or compromised credentials—to launch the exploit. Once this interaction is achieved, the attacker can view sensitive information or, in the worst case, see all content stored within the instance, causing a loss of confidentiality.

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are affected. It is inferred that any deployment that exposes the Content Server instance to external HTTP traffic is vulnerable, regardless of internal network segmentation. It is also inferred that the vulnerability does not rely on privileged local access.

The CVSS v3.1 base score of 5.3 reflects a moderate confidentiality impact, with authentication not required but user interaction needed. The EPSS score is reported as <1%, indicating a very low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited current exploitation activity. Based on the description, it is inferred that the requirement for human interaction means that targeted social‑engineering attacks could still succeed in environments where users can be lured to click malicious links or disclose credentials. Organizations that expose Content Server to the internet should therefore treat this risk as non‑negligible at the minimum.