A flaw in Oracle JDeveloper, part of Oracle Fusion Middleware, permits an unauthenticated attacker who can reach the application over HTTP to create, delete, or modify data reliant on the editor. The weakness is reflected in a CVSS 3.1 score of 5.9, which emphasizes a medium severity with a primary impact on integrity rather than confidentiality or availability. The nature of the vulnerability suggests that information managed by JDeveloper could be altered without the owner’s knowledge, potentially corrupting critical development artifacts or configuration settings.

The issue affects the 12.2.1.4.0 and 14.1.2.0.0 builds of Oracle JDeveloper. These versions are commonly deployed within developer workstations or as components of larger Oracle Fusion Middleware stacks. No other JDeveloper releases are listed as vulnerable.

Based on the description, the likely attack vector is unauthenticated HTTP access; attackers only need network connectivity over HTTP and do not require credentials, implying a straightforward remote exploitation path. The EPSS score is not available and the vulnerability is not currently enrolled in the CISA KEV catalog, which indicates no publicly leveraged exploitation is known yet. Nonetheless, because the flaw allows full data manipulation, operators of the affected systems should treat the risk as significant and act promptly.