Authentication Bypass in Oracle Identity Manager

Compliance Impact

This vulnerability allows an unauthenticated attacker with network access to compromise the Oracle Identity Manager, resulting in unauthorized read, update, insert, or delete access to some accessible data. Such unauthorized access to sensitive identity data could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

However, the provided information does not explicitly mention the impact on compliance with specific standards or regulations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Identity Manager product of Oracle Fusion Middleware, specifically in the End User Self Service component. It affects supported versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is easily exploitable by an unauthenticated attacker who has network access via IIOP (Internet Inter-ORB Protocol).

Successful exploitation allows the attacker to compromise the Identity Manager by gaining unauthorized ability to update, insert, or delete some accessible data, as well as unauthorized read access to a subset of accessible data.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability includes unauthorized modification and disclosure of data within the Identity Manager system. An attacker can update, insert, or delete data without authorization, and also read some data they should not have access to.

This can lead to data integrity issues, potential data breaches, and unauthorized changes to identity management information, which could affect system security and trust.

Useful 0 Not Useful 0