## Summary
Oracle Identity Manager (Oracle Fusion Middleware), specifically the OIM Legacy UI component, contains a network-accessible vulnerability affecting supported versions 12.2.1.4.0 and 14.1.2.1.0. The issue is described as easily exploitable by a low-privileged attacker with HTTP network access, with successful exploitation potentially leading to full takeover of Oracle Identity Manager.
## Technical Details
- Affected component: OIM Legacy UI (Oracle Fusion Middleware / Oracle Identity Manager)
- Attack vector: NETWORK via HTTP
- Required privileges: PR:L (low privileged)
- User interaction: UI:N (no user interaction)
- Impact scope: S:U (unchanged scope)
- Likely impact categories (per NVD): C:H, I:H, A:H (high confidentiality, integrity, and availability impact)
## Affected
- Oracle Identity Manager (OIM Legacy UI)
- 12.2.1.4.0
- 14.1.2.1.0
## Impact
- Compromise / takeover of Oracle Identity Manager after successful exploitation
- High impact on confidentiality, integrity, and availability (C:H, I:H, A:H)
## Mitigation
1. Patch/upgrade Oracle Identity Manager OIM Legacy UI for versions 12.2.1.4.0 and 14.1.2.1.0 (exact fixed versions not provided in the available material).
2. Restrict inbound access to the affected OIM Legacy UI over HTTP to only trusted networks/hosts.
3. Monitor for suspicious HTTP requests targeting the legacy UI endpoints and validate that only expected clients can reach the service.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H