Oracle WebCenter Enterprise Capture Remote Code Execution

Executive Summary

This vulnerability exists in the Oracle WebCenter Enterprise Capture product, specifically in the Client Bundle component. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is easily exploitable by a low privileged attacker who has network access via the T3 protocol. Exploiting this vulnerability can allow the attacker to compromise Oracle WebCenter Enterprise Capture.

The vulnerability has a high severity with a CVSS 3.1 base score of 9.9, indicating critical impacts on confidentiality, integrity, and availability. Successful exploitation can lead to a complete takeover of the Oracle WebCenter Enterprise Capture system.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker to take over the Oracle WebCenter Enterprise Capture system. This means the attacker could gain unauthorized access, manipulate data, disrupt services, and potentially extend the impact to additional products beyond Oracle WebCenter Enterprise Capture.

The impacts include severe breaches of confidentiality, integrity, and availability, which could lead to data loss, unauthorized data disclosure, and service outages.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a low privileged attacker with network access to fully compromise Oracle WebCenter Enterprise Capture, resulting in a complete takeover of the product.

Given the CVSS score of 9.9 with high impacts on confidentiality, integrity, and availability, successful exploitation could lead to unauthorized access to sensitive data, data manipulation, and service disruption.

Such impacts could negatively affect compliance with data protection regulations and standards like GDPR and HIPAA, which require the protection of sensitive personal and health information against unauthorized access and ensure data integrity and availability.

Useful 0 Not Useful 0