Remote Code Execution in Oracle WebCenter Content

Executive Summary

This vulnerability exists in the Oracle WebCenter Content product of Oracle Fusion Middleware, specifically in the Content Server component. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is easily exploitable by a low privileged attacker who has network access via HTTP. Successful exploitation can lead to a complete takeover of Oracle WebCenter Content.

The vulnerability allows an attacker to compromise confidentiality, integrity, and availability of the affected system, as indicated by a high CVSS 3.1 base score of 9.9.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can result in a full takeover of Oracle WebCenter Content, which means an attacker could gain unauthorized control over the system.

• Compromise of confidentiality, allowing unauthorized access to sensitive information.
• Compromise of integrity, enabling attackers to alter or manipulate data.
• Compromise of availability, potentially causing denial of service or disruption of services.

Additionally, because the vulnerability's scope may extend beyond Oracle WebCenter Content, other related products could also be significantly impacted.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a low privileged attacker with network access to compromise Oracle WebCenter Content, potentially resulting in a full takeover of the system. Given the high impact on confidentiality, integrity, and availability (CVSS score 9.9), successful exploitation could lead to unauthorized access to sensitive data.

Such a compromise could negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive personal and health information. A breach resulting from this vulnerability could lead to data exposure, loss of data integrity, and service unavailability, all of which are critical compliance concerns.

Useful 0 Not Useful 0