Oracle Commerce Guided Search Endeca Application Controller Unauthorized Data Access Vulnerability

A vulnerability has been disclosed in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, specifically in the Endeca Application Controller component. The affected supported version is 11.4.0.

The vulnerability is easily exploitable by an unauthenticated attacker with network access via HTTP. While the vulnerability is in Oracle Commerce Guided Search / Oracle Commerce Experience Manager, attacks may significantly impact additional products (scope change).

Successful attacks can result in unauthorized access to critical data, complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data, and unauthorized update, insert, or delete access to some accessible data.

• Affected version: 11.4.0
• CVSS 3.1 Base Score: 9.3 (Confidentiality and Integrity impacts)
• CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N)