Oracle Http Server
Monthly
Cross-boundary compromise of Oracle HTTP Server (a component of Oracle Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker sending crafted HTTP traffic can gain read and write access to critical server-accessible data and, via a scope change, impact additional co-located products. The CVSS 3.1 base score is 8.7 with high confidentiality and integrity impact but no availability impact, and the flaw is classified as improper access control (CWE-284) with an Authentication Bypass tag. Currently there is no public exploit identified at time of analysis, EPSS risk is low (0.03%, 9th percentile), and CISA's SSVC rates exploitation as none despite a 'total' technical impact rating.
Cross-boundary compromise of Oracle HTTP Server (a component of Oracle Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker sending crafted HTTP traffic can gain read and write access to critical server-accessible data and, via a scope change, impact additional co-located products. The CVSS 3.1 base score is 8.7 with high confidentiality and integrity impact but no availability impact, and the flaw is classified as improper access control (CWE-284) with an Authentication Bypass tag. Currently there is no public exploit identified at time of analysis, EPSS risk is low (0.03%, 9th percentile), and CISA's SSVC rates exploitation as none despite a 'total' technical impact rating.