Oracle HTTP Server OSSL Module Critical Data Integrity Vulnerability

A vulnerability has been disclosed in Oracle HTTP Server, part of Oracle Fusion Middleware, specifically in the OSSL Module. Supported affected versions are 12.2.1.4.0 and 14.1.2.0.0.

The flaw is easily exploitable by a low-privileged attacker with network access via HTTP, and can compromise Oracle HTTP Server. Attacks may significantly impact additional products due to scope change.

• Successful attacks can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data.
• They can also result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data.
• CVSS 3.1 Base Score 9.6 with Confidentiality and Integrity impacts.
• CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).