Unauthenticated data tampering and partial service interruption

Improper access control in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows remote attackers to modify data or interrupt service via HTTP. Oracle has disclosed only that the flaw is in the Runtime Tools component; the vulnerable code path and the wrong operation it performs on untrusted input have not been published in the CVE record or vendor advisory. Exploitation is network-reachable without credentials but requires human interaction from another person, and the published impact is limited to unauthorized data creation, deletion, or modification plus partial denial of service rather than full takeover.