The vulnerability allows an attacker who has logged into the infrastructure where Oracle Outside In Technology is running to compromise the product without needing any credentials. The attack requires the presence of an additional person (not the attacker) and active user interaction, and can lead to full takeover of the product, exposing all functionality and data. The CVSS 3.1 vector indicates high impact on confidentiality, integrity and availability.

Oracle Outside In Technology version 8.5.8 is affected. The product operates within Oracle Fusion Middleware and the Core component of Outside In Technology is impacted.

With a CVSS base score of 7.8, the vulnerability is classified as high severity. The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers need local access to the host or network where Outside In Technology runs and must persuade a separate user to interact with the system. Once the conditions are met, the risk of exploitation is significant, especially in environments where physical or network-level access is not tightly controlled.