The flaw lies in the Content Server component of Oracle WebCenter Content, allowing an unauthenticated attacker who can reach the service over HTTP to perform unauthorized update, insert, delete, or read operations on data that the legitimate user would normally be able to alter or view. This breach compromises both confidentiality and integrity of that data. The weakness is consistent with improper access control and authentication deficiencies.

All installations of Oracle WebCenter Content, part of Oracle Fusion Middleware, running the exact release 14.1.2.0.0 are affected. No other versions are listed as vulnerable.

The CVSS 3.1 base score is 5.4, indicating moderate severity. Exploitation requires only network access over HTTP and no privileges, but it does require a human interaction element—an attacker must entice a legitimate user to access a malicious URL or document. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known public exploitation yet. Nonetheless the potential for data tampering and unauthorized disclosure warrants prompt remediation.