Oracle Commerce Service Center
Monthly
Oracle Commerce Service Center 11.4.0 exposes an unauthenticated network-exploitable vulnerability that requires victim interaction and produces a scope change, consistent with a client-side injection or authentication-bypass pattern affecting additional downstream products. Tagged as an authentication bypass by the reporting source, the flaw allows a remote unauthenticated attacker to achieve unauthorized read access to a subset of Commerce Service Center data and unauthorized write, insert, or delete access to some accessible data - outcomes typical of session hijacking or reflected injection chains. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Oracle Commerce Service Center 11.4.0 exposes an unauthenticated network-exploitable vulnerability that requires victim interaction and produces a scope change, consistent with a client-side injection or authentication-bypass pattern affecting additional downstream products. Tagged as an authentication bypass by the reporting source, the flaw allows a remote unauthenticated attacker to achieve unauthorized read access to a subset of Commerce Service Center data and unauthorized write, insert, or delete access to some accessible data - outcomes typical of session hijacking or reflected injection chains. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.