Critical Vulnerability in Oracle Fusion Middleware's Identity Manager

What changed

Oracle has disclosed a serious vulnerability in the Identity Manager component of its Fusion Middleware suite. This flaw, categorized as a missing authentication for critical functions, poses a high risk to users.

With a CVSS score of 9.8, the vulnerability allows unauthenticated attackers with network access via HTTP to exploit the system, leading to potential takeover of the Identity Manager.

Who is affected

Several versions of Oracle Fusion Middleware are impacted by this vulnerability, specifically versions 12.2.1.4.0 and 14.1.2.1.0.

Organizations utilizing these versions should be particularly vigilant, as the flaw could compromise sensitive identity management functions.

• Oracle Fusion Middleware 12.2.1.4.0
• Oracle Fusion Middleware 14.1.2.1.0
• Users of Identity Manager within enterprise environments

What to do

Organizations using the affected versions of Oracle Fusion Middleware should take immediate action to mitigate the risk associated with this vulnerability.

Implementing security patches and reviewing access controls are critical steps to protect against potential exploitation.

• Apply security patches provided by Oracle.
• Review and enhance access controls for Identity Manager.
• Monitor network traffic for any unauthorized access attempts.