Remote Code Execution in Oracle WebCenter Content

Compliance Impact

The vulnerability allows a low privileged attacker with network access to compromise Oracle WebCenter Content, potentially resulting in full takeover of the system. Given the high impact on confidentiality, integrity, and availability (CVSS score 9.9), successful exploitation could lead to unauthorized access to sensitive data.

Such unauthorized access and system compromise could negatively affect compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive information and ensuring system integrity and availability.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Oracle WebCenter Content product of Oracle Fusion Middleware, specifically in the Content Server component. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is easily exploitable by a low privileged attacker who has network access via HTTP. Successful exploitation can lead to a complete takeover of Oracle WebCenter Content.

The vulnerability has a high severity with a CVSS 3.1 base score of 9.9, indicating critical impacts on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker to take over the Oracle WebCenter Content system. This means the attacker could gain unauthorized access, modify or delete content, disrupt services, and potentially affect other connected products due to the scope change.

The impacts include loss of confidentiality, integrity, and availability of the affected system, which can lead to significant operational and security risks.

Useful 0 Not Useful 0