Description

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:35.517Z",
  "pubdate": "2026-08-18T21:17:35.517Z",
  "executiveSummary": "An unauthenticated remote vulnerability affects the Oracle Scripting component of Oracle E-Business Suite versions 12.2.3 through 12.2.15.\nThe flaw resides within the Internal Operations subcomponent and allows remote attackers with network access via HTTP to bypass security controls without requiring credentials or user interaction.\nSuccessful exploitation leads to unauthorized data access, specifically impacting confidentiality by granting attackers read access to critical data or complete access to all data accessible via Oracle Scripting.\nThe vulnerability presents a significant risk due to its low attack complexity and the absence of authentication or privilege requirements.\nMitigation requires applying vendor-supplied patches and restricting network access to vulnerable services.",
  "technicalDetails": "The vulnerability exists within the Internal Operations component of Oracle Scripting in Oracle E-Business Suite versions 12.2.3 to 12.2.15.\nThe attack vector is network-based (AV:N), utilizing the HTTP protocol to interact with the vulnerable application endpoints.\nThe vulnerability is characterized by low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N).\nThe CVSS 3.1 vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), yielding a base score of 7.5 with impacts strictly limited to confidentiality (C:H) while integrity (I:N) and availability (A:N) remain unaffected.\nThe scope (S:U) remains unchanged, indicating the vulnerability does not cross security boundaries.\nExploitation occurs when an unauthenticated attacker sends crafted HTTP requests directly to the vulnerable Oracle Scripting interface.\nDue to improper input validation, access control enforcement, or logic flaws within the Internal Operations component, the application fails to adequately verify whether the requester is authorized to view the requested data.\nUpon processing the malicious request, the underlying component improperly discloses sensitive database contents or application data accessible to the Oracle Scripting module.\nThe post-exploitation impact includes the mass exfiltration of sensitive information stored within or managed by the Oracle Scripting application, potentially exposing proprietary business data or customer records depending on the data accessible to the compromised component."
}