This vulnerability affects Oracle Site Hub versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product by gaining unauthorized ability to read, update, insert, or delete some accessible data. Additionally, the attacker can cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory from Oracle does not explicitly mention a specific patch for this vulnerability but advises customers to apply Critical Patch Updates without delay. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized read access to some Oracle Site Hub data, unauthorized modification (update, insert, delete) of some data, and the ability to cause a partial denial of service affecting availability. The impact affects confidentiality, integrity, and availability but is limited in scope as indicated by the CVSS score of 6.3.

Oracle's advisory does not explicitly state a specific patch for this vulnerability but strongly recommends that customers remain on actively-supported versions and apply Critical Patch Updates promptly. Since no direct patch or temporary fix is confirmed in the advisory, organizations should monitor Oracle's Critical Patch Update releases and apply relevant patches as soon as they become available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.