CVE-2026-34324
Unauthorized Data Access via HTTP in Oracle Life Sciences InForm
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | life_sciences_inform | 7.0.1.0 |
| oracle | life_sciences_inform | 7.0.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Life Sciences InForm product, specifically in the App Server component of versions 7.0.1.0 and 7.0.1.1.
It allows an unauthenticated attacker with network access via HTTP to exploit the system easily.
Successful exploitation can lead to unauthorized ability to update, insert, or delete some accessible data, as well as unauthorized read access to a subset of accessible data within Oracle Life Sciences InForm.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker without any authentication to access and modify data within Oracle Life Sciences InForm.
- Unauthorized update, insert, or deletion of some accessible data.
- Unauthorized read access to a subset of accessible data.
This could lead to data integrity issues and potential exposure of sensitive information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker to gain unauthorized read and write access to data within Oracle Life Sciences InForm. Such unauthorized access and modification of data can lead to violations of data protection and privacy regulations, including GDPR and HIPAA, which require strict controls over the confidentiality and integrity of sensitive information.
Specifically, the compromise of confidentiality and integrity of accessible data may result in non-compliance with requirements for protecting personal and health information, potentially leading to legal and regulatory consequences.