A vulnerability in Oracle WebCenter Sites allows an unauthenticated attacker with network access through HTTP to gain unauthorized access to critical data. The flaw can lead to exfiltration of confidential information or full exposure of all accessible data within the site. This weakness directly undermines data confidentiality, as indicated by the CVSS vector with a high confidentiality impact and no integrity or availability consequences.

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These are part of Oracle Fusion Middleware and may be installed in enterprise web portals and content management solutions.

The CVSS 3.1 score of 5.9 reflects moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires an unauthenticated HTTP connection to the target, suggesting that exposed web interfaces are the primary entry point. While the description indicates the vulnerability is difficult to exploit, an attacker could potentially leverage it to read sensitive data if they can reach the vulnerable interface.