This vulnerability affects Oracle Helidon versions 4.0.0 through 4.5.1 and is exploitable remotely without authentication over HTTP. It permits unauthorized modification and reading of some data accessible through Helidon. The vulnerability's scope extends beyond Helidon, potentially impacting other Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with limited confidentiality and integrity impact but no availability impact. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability and strongly recommends applying patches promptly. However, the specific patch availability for Helidon versions mentioned is not explicitly confirmed in the advisory content provided.

An attacker with network access via HTTP can exploit this vulnerability without authentication to gain unauthorized read and write access to certain data in Helidon. This includes the ability to update, insert, or delete data, which compromises confidentiality and integrity of the affected data. The vulnerability's scope change means that other Oracle products relying on Helidon may also be affected, increasing the potential impact.

Oracle has released a Critical Security Patch Update that addresses this vulnerability among many others. Customers are strongly advised to remain on actively supported versions and apply Oracle security patches without delay. Since the advisory does not explicitly confirm patch availability for the affected Helidon versions, users should consult the Oracle Critical Security Patch Update documentation and apply the relevant patches as soon as they become available. No vendor advisory states that no action is required or that the issue is already mitigated.