Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:18:21.297Z",
  "pubdate": "2026-08-18T21:18:21.297Z",
  "executiveSummary": "An information disclosure vulnerability has been identified within the Imperative Web Server component of Oracle Fusion Middleware Helidon, specifically affecting version 4.5.0.\nThis security flaw allows unauthenticated remote attackers with network access via the HTTP protocol to compromise the affected application and gain unauthorized read access to a subset of Helidon accessible data.\nThe vulnerability presents a moderate risk profile with a CVSS 3.1 Base Score of 5.3, where the impact is strictly limited to confidentiality degradation without affecting integrity or system availability.\nExploitation of this vulnerability requires no user interaction, low attack complexity, and no prior authentication or elevated privileges, making it easily exploitable over the network.\nOrganizations deploying the affected version of Helidon face potential exposure of sensitive data processed or hosted by the Imperative Web Server component.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0.\nThe root cause involves improper handling of HTTP requests, leading to unauthorized read access to internal resources or sensitive data subsets accessible through the web server.\nAttackers leverage network access via the HTTP protocol to interact directly with the vulnerable Helidon Imperative Web Server endpoint.\nBecause the vulnerability requires no authentication (PR:N) and no user interaction (UI:N), an unauthenticated remote attacker can craft specialized HTTP requests designed to bypass access controls or data segregation boundaries within the web server architecture.\nUpon transmitting the malicious HTTP payload, the vulnerable component improperly processes the request and returns sensitive data contained within the accessible dataset to the unauthorized client.\nThe attack vector is entirely network-based (AV:N) with low attack complexity (AC:L), allowing automated scanning and exploitation scripts to successfully extract information without requiring deep knowledge of the underlying infrastructure.\nThe post-exploitation impact is restricted to confidentiality (C:L), enabling unauthorized retrieval of data subsets while leaving system integrity (I:N) and availability (A:N) uncompromised."
}