A flaw in the Runtime Tools component of Oracle WebCenter Portal allows an unauthenticated attacker to send HTTP requests that bypass authentication and authorization, exposing all data accessible through the portal for reading. The vulnerability is classified as an Improper Authorization and Authentication weakness (CWE-285) and results in a confidentiality breach while leaving integrity and availability unchanged.

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 are affected when the Runtime Tools feature is enabled and exposed over HTTP. No other Oracle Fusion Middleware products are listed as impacted.

The CVSS 3.1 base score of 6.5 indicates a moderate severity flaw that can be exploited over the network via HTTP. The EPSS score of less than 1% suggests a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack requires human interaction from a user other than the attacker, implying that a legitimate user must initiate or forward a request to the vulnerable endpoint; this inference limits fully automated attacks but still permits unauthenticated read access if a user transmits a request.