Oracle Commerce Platform Dynamo Personalization Server Vulnerability Allowing Unauthorized Data Access and Modification

A vulnerability exists in the Oracle Commerce Platform, specifically within the Dynamo Personalization Server component. It affects versions 11.3.0, 11.3.1, and 11.3.2. This vulnerability allows a low-privileged attacker with network access via HTTP to compromise the Oracle Commerce Platform. Exploitation of this vulnerability requires human interaction from someone other than the attacker. While the issue is contained within the Oracle Commerce Platform, successful attacks could significantly impact other products, leading to a scope change. The vulnerability allows for unauthorized updates, inserts, or deletions of certain accessible data within the Oracle Commerce Platform, as well as unauthorized read access to a subset of that data.

Impact

Exploitation of this vulnerability could result in unauthorized access to read, modify, or delete certain data within the Oracle Commerce Platform.