Identity Manager Authentication Bypass Vulnerability

Compliance Impact

This vulnerability allows a low privileged attacker with network access to compromise Oracle Identity Manager, potentially resulting in a complete takeover of the system.

Such a compromise can lead to unauthorized access, modification, and disruption of sensitive identity management data, which may impact confidentiality, integrity, and availability.

Consequently, this could affect compliance with common standards and regulations such as GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Identity Manager product of Oracle Fusion Middleware, specifically in the Security component. It affects supported versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is easily exploitable by a low privileged attacker who has network access via HTTP.

A successful attack can lead to the complete takeover of the Identity Manager, compromising its confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker to take over the Identity Manager system. This means the attacker could gain unauthorized access to sensitive identity management functions and data.

The impact includes a high level of compromise to confidentiality, integrity, and availability of the system, potentially leading to data breaches, unauthorized changes, and service disruptions.

Useful 0 Not Useful 0