Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:18:23.793Z",
  "pubdate": "2026-08-18T21:18:23.793Z",
  "executiveSummary": "An information disclosure vulnerability has been identified within the Imperative Web Server component of Oracle Fusion Middleware Helidon, specifically affecting version 4.5.1. This security flaw enables an unauthenticated remote attacker with network access via the HTTP protocol to compromise the confidentiality of the affected deployment. Successful exploitation of this vulnerability results in unauthorized read access to a subset of data accessible by Helidon. The vulnerability carries a CVSS 3.1 Base Score of 5.3 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it is easily exploitable over the network without requiring any user interaction, authentication, or elevated privileges. The risk implication centers entirely on the compromise of data confidentiality, potentially exposing sensitive application data or internal state information to unauthorized entities. Remediation requires applying the appropriate vendor-supplied patches or updates to resolve the underlying flaw in the affected component.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Helidon version 4.5.1. The root cause involves improper handling of incoming HTTP requests or inadequate access controls within the web server processing logic, which permits unauthenticated remote clients to retrieve data they should not be authorized to access. Because the vulnerability is exposed via the network attack vector (AV:N), an attacker does not require local access or physical proximity to the target system. The attack complexity is rated as low (AC:L), meaning that successful exploitation does not demand sophisticated conditions, race conditions, or complex payload configurations. Furthermore, the vulnerability requires no privileges (PR:N) and no user interaction (UI:N), allowing automated scripts or remote threat actors to query the vulnerable endpoint directly.\nThe attack flow proceeds as follows: An unauthenticated attacker crafts a standard HTTP request targeted at the vulnerable Imperative Web Server component within the Helidon runtime. Due to the flaw in request processing or data authorization checks, the web server fails to properly validate whether the requesting entity possesses the necessary permissions to access the targeted resource. Consequently, the server processes the request and returns a response containing a subset of Helidon-accessible data back to the client. The scope is unchanged (S:U), as the vulnerability's impact is contained within the confines of the vulnerable component itself without escalating privileges to other underlying security domains or host operating system resources. The post-exploitation impact is strictly limited to unauthorized read access (C:L), meaning integrity and availability impacts are absent; however, the leaked data subset could potentially be leveraged for reconnaissance or secondary attacks against the application architecture."
}