Description

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Installed Base accessible data as well as unauthorized read access to a subset of Oracle Installed Base accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Installed Base. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T21:17:30.457Z",
  "pubdate": "2026-08-18T21:17:30.457Z",
  "executiveSummary": "A vulnerability has been identified within the User Interface component of the Oracle Installed Base product, part of the Oracle E-Business Suite. This security flaw is categorized as an easily exploitable vulnerability that allows a low-privileged remote attacker with network access via HTTP to compromise the affected system. Successful exploitation of this vulnerability impacts all three pillars of information security: confidentiality, integrity, and availability. Specifically, an unauthorized attacker can achieve unauthorized read, update, insert, and delete access to a subset of data accessible within Oracle Installed Base, alongside causing a partial denial of service condition. The vulnerability affects supported software versions ranging from 12.2.3 to 12.2.15. The CVSS 3.1 base score for this issue is 6.3, reflecting moderate to high operational risk due to the breadth of potential data manipulation and service degradation. Exploitation requires network connectivity via the HTTP protocol, low privileges within the application context, but does not require user interaction, making automated or targeted session-based attacks feasible for an authenticated malicious actor.",
  "technicalDetails": "The vulnerability resides within the User Interface component of the Oracle Installed Base product in Oracle E-Business Suite versions 12.2.3 through 12.2.15. The root cause stems from insufficient access controls, input validation, or authorization checks within the HTTP-exposed endpoints managed by the User Interface layer. Because the attack vector is network-based (AV:N), an attacker does not require physical or local access to the underlying host operating system; instead, communications are established remotely over the HTTP protocol. The attack complexity is rated as low (AC:L), indicating that the conditions required to successfully exploit the flaw are reliably achievable by an adversary without requiring complex race conditions, specialized configurations, or advanced cryptographic bypasses.\nTo execute an attack, a malicious actor must first provision valid low-privileged credentials (PR:L) to authenticate against the Oracle E-Business Suite environment. Upon establishing an authenticated session, the attacker crafts specialized HTTP requests directed at vulnerable User Interface endpoints within Oracle Installed Base. Due to the lack of adequate server-side validation and authorization enforcement, the application processes these malicious requests without verifying whether the authenticated user possesses the administrative or functional rights required to perform the requested data transactions or system operations.\nThe attack flow allows the low-privileged attacker to execute unauthorized database queries and transactions, resulting in the exposure of sensitive data via unauthorized read access (C:L), as well as the modification, injection, or destruction of records via unauthorized update, insert, or delete access (I:L). Furthermore, payload behavior may include resource exhaustion, malformed transaction processing, or logic abuse that triggers a partial denial of service (A:L) condition, degrading the operational availability of the Oracle Installed Base component for legitimate users. Post-exploitation impact encompasses compromised data integrity and confidentiality within the scope of the application data model, alongside localized availability disruptions requiring administrative intervention to restore normal service states."
}