Description

Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SDP Number Portability. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SDP Number Portability accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:33.960Z",
  "pubdate": "2026-08-18T21:17:33.960Z",
  "executiveSummary": "An unauthorized information disclosure vulnerability affects the Oracle SDP Number Portability component of Oracle E-Business Suite, specifically within the Internal Operations sub-component. This remotely exploitable flaw allows unauthenticated threat actors with network access to compromise the affected software and achieve unauthorized access to critical or completely accessible data.\nThe vulnerability presents a significant risk to organizational data security by exposing sensitive information managed by the Oracle SDP Number Portability product. The attack vector is strictly network-based utilizing the HTTP protocol, requiring no user interaction or prior authentication. The low attack complexity enables malicious actors to execute exploitation attempts reliably against exposed endpoints.\nAffected software versions encompass Oracle E-Business Suite releases 12.2.3 through 12.2.15. Successful exploitation strictly impacts confidentiality, resulting in the unauthorized retrieval of sensitive data without causing direct integrity or availability disruption.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of the Oracle SDP Number Portability product, which forms part of the broader Oracle E-Business Suite architecture supporting versions 12.2.3 through 12.2.15. The root cause stems from insufficient access controls and inadequate input validation or authorization enforcement within the web-accessible routines handling internal operations over HTTP.\nExploitation is conducted entirely over the network via HTTP without requiring any pre-existing authentication credentials or privileges. The attacker initiates standard HTTP requests directed at vulnerable endpoints exposed by the Internal Operations component. Because the application fails to adequately verify whether the connecting entity possesses authorization to view sensitive operational data, the targeted functionality processes the request and returns the requested proprietary dataset within the HTTP response payload.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies the network-accessible HTTP endpoints associated with the Oracle SDP Number Portability Internal Operations component. Second, the attacker transmits crafted HTTP requests to the target interface, bypassing authentication barriers due to missing authorization checks in the component logic. Third, the application processes the retrieval request against internal data repositories. Finally, the server returns an HTTP response containing critical, sensitive, or completely accessible data belonging to the Oracle SDP Number Portability product, fulfilling the confidentiality breach.\nThe CVSS 3.1 vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The attack vector (AV) is Network, attack complexity (AC) is Low, privileges required (PR) are None, user interaction (UI) is None, and scope (S) is Unchanged. The impact metric highlights High confidentiality (C) impact, with no integrity (I) or availability (A) impacts."
}