Oracle WebCenter Sites HTTP Vulnerability Leads to Takeover

A vulnerability has been reported in Oracle WebCenter Sites, a product in Oracle Fusion Middleware (component: WebCenter Sites). The flaw is a takeover vulnerability affecting supported versions 12.2.1.4.0 and 14.1.2.0.0.

The vulnerability is easily exploitable and allows a high-privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Although the vulnerability is in Oracle WebCenter Sites, successful attacks may significantly impact additional products (scope change).

• Affected versions: 12.2.1.4.0 and 14.1.2.0.0
• Attack vector: network access via HTTP
• Privileges required: high
• Impact: takeover of Oracle WebCenter Sites; scope change to additional products
• CVSS 3.1 Base Score: 9.1 (Confidentiality, Integrity and Availability impacts)
• CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)