Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:18:23.343Z",
  "pubdate": "2026-08-18T21:18:23.343Z",
  "executiveSummary": "An unauthenticated information disclosure vulnerability has been identified within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. This security flaw enables remote attackers with network access to compromise the affected system via the HTTP protocol without requiring prior authentication or user interaction. Successful exploitation of this vulnerability yields unauthorized read access to a specific subset of data accessible within the Helidon environment, directly impacting confidentiality. The vulnerability is classified as easily exploitable due to the absence of prerequisite privileges or complex attack conditions, presenting a notable risk to enterprise deployments relying on the affected software version. The CVSS 3.1 base score is 5.3, reflecting purely confidentiality-related impacts with no integrity or availability disruption. Remediation efforts should focus on applying vendor-supplied patches or upgrading to unaffected versions as soon as they become available.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon, specifically affecting version 4.5.0. The root cause involves improper handling of HTTP requests, which allows remote actors to bypass intended access restrictions and retrieve sensitive data managed by the application server. Because the vulnerability is exposed via the network vector using standard HTTP protocols, an attacker does not require local system access or specialized privileges. The attack flow begins when an unauthenticated client sends a maliciously crafted HTTP request targeting the vulnerable Imperative Web Server component. Upon processing the request, the flawed request handling logic fails to adequately validate or restrict the scope of accessible resources, thereby returning sensitive data subsets to the unauthorized requester. The payload behavior is strictly passive from an execution standpoint, focusing on data exfiltration rather than code execution or denial of service, aligning with the confidentiality-only impact metric specified in the CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Post-exploitation impact is limited to the unauthorized disclosure of data accessible within the context of the Helidon application server. Since the vulnerability requires no interaction and presents a low attack complexity, automated scanning or exploitation scripts can rapidly identify and query vulnerable endpoints across exposed network perimeters."
}