Vulnerabilities Fixed in Oracle Identity Manager Connector (advisories.ncsc.nl)

• Unauthenticated attacker can manipulate critical data over HTTPS/HTTP.
• Denial-of-service possible via service crash or hang.
• Low-privilege attacker can access critical data via LDAP.

"Oracle has fixed multiple vulnerabilities in Oracle Identity Manager Connector version 12.2.1.4.0. An unauthenticated attacker can perform unauthorized actions via network access over HTTPS/HTTP, including creating, deleting, or modifying critical data. Also possible denial-of-service. Additionally, a low-privilege attacker via LDAP can read, modify, or delete critical data."