Authentication Bypass in Oracle Access Manager

Compliance Impact

This vulnerability allows an unauthenticated attacker with network access to compromise Oracle Access Manager, resulting in unauthorized read and write access to some accessible data. Such unauthorized access and modification of data can potentially lead to violations of data protection standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality and integrity.

Because the vulnerability impacts confidentiality and integrity of data, organizations using affected versions of Oracle Access Manager may face increased risk of non-compliance with these regulations if exploited.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Oracle Access Manager product, specifically in the Authentication Engine component of Oracle Fusion Middleware. It affects supported versions 12.2.1.4.0 and 14.1.2.1.0.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability easily. Successful exploitation allows the attacker to perform unauthorized updates, inserts, or deletions on some data accessible by Oracle Access Manager, as well as unauthorized read access to a subset of that data.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability includes unauthorized modification and disclosure of data within Oracle Access Manager. An attacker could alter or delete data they should not have access to, or read sensitive information without authorization.

This can lead to compromised data integrity and confidentiality, potentially affecting the security and trustworthiness of systems relying on Oracle Access Manager for authentication and access control.

Useful 0 Not Useful 0