CVE-2019-2578: Oracle WebCenter Sites Advanced UI unauthenticated data exposure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable high confidentiality impact with a very high EPSS score, though no KEV listing or public exploit detail is present.

What it is

Oracle WebCenter Sites 12.2.1.3.0 contains a flaw in the Advanced UI subcomponent that is reachable over HTTP without authentication. A successful attack can expose critical data or all data accessible through the WebCenter Sites instance, and Oracle notes the impact may extend to additional products.

Impact

An unauthenticated attacker gains read access to critical data, potentially all data reachable through the affected WebCenter Sites deployment. The scope change indicates the compromise can affect resources beyond the vulnerable component.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The record does not specify the exact endpoint or request needed.

Exploitation

Not listed in CISA KEV and no public exploit reference is provided, but EPSS is very high at 0.724 (99.4th percentile), indicating elevated predicted exploitation activity.

What to do

• Apply the Oracle Critical Patch Update April 2019 fix referenced in the vendor advisory.
• Upgrade or remove unsupported WebCenter Sites 12.2.1.3.0 deployments; confirm the fixed version with Oracle.
• Restrict network access to WebCenter Sites HTTP interfaces to trusted users and networks.
• Place the application behind a reverse proxy or WAF and monitor for anomalous unauthenticated requests to Advanced UI paths.
• Review WebCenter Sites data exposure and rotate credentials or secrets that may have been reachable.

Detection

• Monitor HTTP access logs for unauthenticated requests to WebCenter Sites Advanced UI endpoints, especially from unexpected source IPs.
• Alert on unusual data retrieval volume or enumeration patterns against WebCenter Sites from single clients.
• Correlate WebCenter Sites access with authentication logs to flag sessions that never authenticated.
• Hunt for known scanning or exploitation attempts against WebCenter Sites in proxy, WAF and IDS telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.