Unauthorized data read and modification

Access-control flaw in Oracle Hyperion Financial Reporting 11.2.25.0.000 allows remote attackers to read and modify data via HTTP. Oracle has disclosed only that the Server component can be compromised by unauthenticated HTTP traffic and has not published the specific endpoint or the incorrect access-control operation that permits unauthorized read, update, insert, or delete actions. Exploitation requires human interaction from another person and can affect additional products through scope change, so exposure depends on whether a reachable workflow lets an attacker induce that interaction.