Description

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Scripting. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T21:17:35.377Z",
  "pubdate": "2026-08-18T21:17:35.377Z",
  "executiveSummary": "A vulnerability exists within the Internal Operations component of the Oracle Scripting product in Oracle E-Business Suite versions 12.2.3 through 12.2.15, posing significant risks to enterprise data security and application availability.\nThe vulnerability allows a low-privileged authenticated attacker with network access via HTTP to execute unauthorized operations against critical assets within the affected system.\nSuccessful exploitation can result in the unauthorized creation, deletion, or modification of critical data, complete unauthorized access to all accessible Oracle Scripting data, and the ability to trigger a partial denial of service condition.\nThe attack vector is network-based, requiring HTTP connectivity and high attack complexity, but does not rely on user interaction.\nThe associated CVSS 3.1 base score is 7.1, with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L, indicating severe implications for confidentiality, integrity, and availability.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Scripting within Oracle E-Business Suite versions 12.2.3 through 12.2.15.\nThe flaw stems from insufficient validation and authorization enforcement within internal operational routines exposed via the HTTP protocol, allowing authenticated users to transcend their intended privilege boundaries.\nExploitation requires the attacker to possess low privileges within the application and network access to the HTTP interfaces exposed by Oracle Scripting.\nWhile the attack complexity is classified as high, requiring precise conditions or state manipulation by the attacker, successful execution bypasses standard access control checks.\nDuring the attack flow, the adversary crafts specialized HTTP requests targeting vulnerable internal routines within the component.\nUpon receipt, the vulnerable component fails to adequately verify whether the authenticated low-privileged user is authorized to perform the requested operations against specific data objects.\nThis authorization bypass permits the execution of unauthorized data modification, creation, and deletion routines, as well as unauthorized retrieval of sensitive data stored or processed by Oracle Scripting.\nAdditionally, malformed or resource-intensive inputs sent via the same attack vector can exhaust application resources, leading to a partial denial of service affecting the availability of Oracle Scripting.\nThe post-exploitation impact spans severe breaches of confidentiality and integrity due to unauthorized data exposure and tampering, alongside degraded system availability."
}