Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:18:21.407Z",
  "pubdate": "2026-08-18T21:18:21.407Z",
  "executiveSummary": "An information disclosure vulnerability has been identified within the Imperative Web Server component of Oracle Fusion Middleware Helidon, specifically affecting version 4.5.0. This security flaw enables unauthenticated malicious actors with network-layer access via the HTTP protocol to compromise the confidentiality of the targeted system. Successful exploitation of this vulnerability yields unauthorized read access to a specific subset of data accessible through the Helidon application framework. The vulnerability carries a CVSS 3.1 Base Score of 5.3, with a vector indicating network attack vector, low attack complexity, and zero privileges or user interaction required. The primary risk implication centers on the unauthorized exposure of sensitive data processed or hosted by the affected web server component. Because the vulnerability is easily exploitable over the network without prior authentication, organizations running the affected Helidon version face immediate exposure to reconnaissance and data leakage attempts by external or internal threat actors who possess network reachability to the web server endpoints.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically impacting version 4.5.0. The root cause stems from insufficient validation or improper access controls implemented within the HTTP request processing logic, allowing unauthorized retrieval of data subsets. The vulnerable component is exposed directly via the network layer, listening for incoming HTTP requests handled by the Imperative Web Server implementation.\nExploitation of this vulnerability does not require authentication, privilege elevation, or user interaction. An attacker leverages standard network access to communicate with the Helidon application over the HTTP protocol. The attack flow begins when the malicious actor crafts and transmits a specific HTTP request targeting vulnerable endpoints managed by the Imperative Web Server. Due to the flaw in how the component processes incoming requests and manages data access boundaries, the server fails to properly enforce confidentiality constraints.\nUpon receiving the malicious payload or crafted request, the vulnerable Imperative Web Server processes the input without adequate security checks, inadvertently returning sensitive data contained within the accessible data subset in the HTTP response body. The post-exploitation impact is strictly limited to unauthorized read access (Confidentiality impact), as indicated by the CVSS vector (C:L/I:N/A:N). The vulnerability does not allow for integrity modifications, code execution, or denial of service conditions against the underlying host or application runtime based on the provided specifications."
}