Description

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Scripting accessible data as well as unauthorized update, insert or delete access to some of Oracle Scripting accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:35.247Z",
  "pubdate": "2026-08-18T21:17:35.247Z",
  "executiveSummary": "An unauthorized access and data manipulation vulnerability affects the Oracle Scripting product within Oracle E-Business Suite, specifically within the Internal Operations component. This security flaw enables low-privileged network attackers to compromise the system via the HTTP protocol without requiring user interaction. Successfully exploiting this vulnerability allows adversaries to gain unauthorized access to critical data or achieve complete access to all data accessible by Oracle Scripting. Furthermore, attackers can execute unauthorized update, insert, or delete operations against a subset of the accessible data within the application. The vulnerability poses significant risk to organizational data confidentiality and integrity, potentially leading to unauthorized data exposure and transactional tampering. Supported versions impacted by this flaw span from 12.2.3 through 12.2.15. The exploitation complexity is rated as low, given that the attacker possesses low privileges and network connectivity. Remediation requires applying the official vendor-supplied security patches associated with the affected product versions to mitigate the identified access control deficiencies.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of Oracle Scripting, a module of Oracle E-Business Suite affecting supported versions 12.2.3 through 12.2.15. The root cause stems from insufficient authorization checks and access control enforcement mechanisms within the application logic processing HTTP requests. Specifically, the vulnerable component fails to adequately validate whether an authenticated user with low privileges possesses the necessary authorization to access or modify specific internal operational datasets. The attack vector is network-based, utilizing the HTTP protocol to interact with the vulnerable application endpoints. Exploitation requires the attacker to possess low privileges within the Oracle E-Business Suite environment, meaning an authenticated user account with minimal baseline access is necessary to initiate the attack sequence. No user interaction is required for successful exploitation, increasing the reliability and stealth of the attack. The attack flow begins when the low-privileged attacker crafts and transmits malicious or unauthorized HTTP requests targeting the vulnerable Internal Operations functions of Oracle Scripting. Due to inadequate server-side validation of user permissions and role assignments, the application processes these requests and grants access to restricted functionality and data handlers. Upon successful exploitation, the payload behavior allows the adversary to read critical and sensitive data, resulting in a severe impact on confidentiality. Additionally, the attacker can perform unauthorized insert, update, and delete actions on select data subsets, directly compromising data integrity. The attack does not inherently result in a loss of availability, as indicated by the CVSS metrics, focusing primarily on data compromise rather than denial of service. The underlying technical weakness involves broken object level authorization or missing function level access control within the enterprise application framework, allowing horizontal or vertical privilege escalation concerning specific data repositories managed by Oracle Scripting."
}