Technical impact
The flaw is an authentication bypass in the Content Server component of Oracle WebCenter Content, inferred from the description that an unauthenticated attacker with network access over HTTP can gain update, insert, or delete rights on protected data and cause a partial denial of service. Because the vulnerability does not affect confidentiality, the primary impacts are integrity and availability, as reflected in the CVSS v3.1 base score of 5.4.
Affected Systems
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These releases are part of Oracle Fusion Middleware and provide enterprise content management functions.
Risk and Exploitability
The CVSS score of 5.4 places the risk in the medium category. An EPSS score of less than 1% indicates a very low probability of remote execution in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires no local credentials but does need the victim to be prompted to interact with the system; the attacker must have HTTP access to the exposed Content Server interface. The combination of a moderate CVSS score, low exploitation probability, and the requirement for user interaction suggests that organizations should prioritize timely patching but may also monitor user activity for suspicious interactions.
