A remote attacker who can reach the Oracle Outside In Technology service over HTTP can exploit a vulnerability in the Outside In Clean Content SDK to create, delete, or modify critical data without authentication. The flaw also permits triggering a hang or frequent crash, effectively denying service to legitimate users. The weakness results in a high impact on integrity and availability of all data accessible through the Oracle Outside In Technology component.

Oracle Outside In Technology version 8.5.8 from Oracle Corporation is affected. The vulnerability is present in this specific release of the Oracle Fusion Middleware product suite.

The CVSS 3.1 base score of 9.1 indicates critical severity, with no authenticated requirement and an unauthenticated network access vector. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated attacker sending crafted HTTP requests to the vulnerable endpoint. Successful exploitation grants unrestricted data modification rights and can lead to a complete denial of service if the attacker repeatedly induces crashes.