Description

Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Proposals. Successful attacks of this vulnerability can result in takeover of Oracle Proposals. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T21:17:31.370Z",
  "pubdate": "2026-08-18T21:17:31.370Z",
  "executiveSummary": "A security vulnerability affecting the Oracle Proposals product within Oracle E-Business Suite poses significant risks to enterprise environments. Specifically impacting the Internal Operations component across supported versions 12.2.3 through 12.2.15, this vulnerability carries a CVSS 3.1 Base Score of 7.2 with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.\nThe vulnerability is characterized as easily exploitable, allowing a high-privileged attacker with network access via the HTTP protocol to compromise the affected application completely. Successful exploitation results in the total takeover of Oracle Proposals, yielding severe impacts on confidentiality, integrity, and availability.\nGiven the requirement for high privileges, the threat vector typically manifests as an authenticated administrator or malicious insider abusing legitimate control pathways or insufficient access controls within the Internal Operations component. The risk implications include unauthorized data access, system manipulation, and service disruption.\nOrganizations utilizing vulnerable instances of Oracle E-Business Suite must apply official vendor patches promptly and enforce strict administrative access controls to mitigate potential exploitation.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of Oracle Proposals, a module integrated into the Oracle E-Business Suite architecture spanning versions 12.2.3 through 12.2.15.\nThe root cause stems from inadequate validation, authorization checks, or flawed logic handling administrative requests within the application layer, which processes HTTP-based network traffic.\nAlthough the vulnerability requires high privileges (PR:H) to execute, its low attack complexity (AC:L) and network attack vector (AV:N) enable an authenticated attacker with administrative credentials to bypass intended security boundaries.\nThe attack flow proceeds as follows: First, the adversary establishes network connectivity to the Oracle E-Business Suite instance via HTTP. Second, utilizing a high-privileged account, the attacker submits specially crafted requests targeted at the Internal Operations component of Oracle Proposals. Third, due to insufficient input validation or flawed access control enforcement within the vulnerable component, the application processes the malicious payload without proper restriction.\nThis behavior facilitates unauthorized execution of administrative functions or direct manipulation of underlying data structures. Upon successful exploitation, the payload achieves a complete takeover of Oracle Proposals (S:U), resulting in high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H).\nPost-exploitation impact includes full administrative control over the Oracle Proposals instance, potentially enabling unauthorized read and write access to sensitive business proposals, modification of system configurations, and disruption of operational workflows."
}