Description

Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Internet Procurement Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Internet Procurement Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Internet Procurement Connector accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:36.210Z",
  "pubdate": "2026-08-18T21:17:36.210Z",
  "executiveSummary": "A vulnerability has been identified within the Oracle Internet Procurement Connector product of Oracle E-Business Suite, specifically within the Internal Operations component. This security flaw affects supported software versions ranging from 12.2.3 to 12.2.15.\nThe vulnerability is classified as easily exploitable, allowing a low-privileged attacker with network access via the HTTP protocol to compromise the affected product. Successful exploitation of this vulnerability does not impact system availability, but it can result in unauthorized creation, deletion, or modification access to critical data or all accessible data within the Oracle Internet Procurement Connector. Furthermore, it grants unauthorized access to critical data or complete access to all accessible data residing in the system.\nGiven its CVSS 3.1 Base Score of 8.1 with confidentiality and integrity impacts, the risk implications are significant for organizations utilizing vulnerable versions of the Oracle E-Business Suite. The attack vector is network-based with low attack complexity, requiring low privileges and no user interaction, making unauthorized data manipulation and exposure primary concerns for system defenders.",
  "technicalDetails": "The vulnerability resides in the Oracle Internet Procurement Connector product of Oracle E-Business Suite, specifically targeting the Internal Operations component across supported versions 12.2.3 through 12.2.15.\nFrom an exploitation perspective, the vulnerability is exposed via the network layer utilizing the HTTP protocol. An attacker must possess low privileges within the application environment to initiate an attack, but the exploitation process requires no user interaction and exhibits low attack complexity.\nThe attack flow begins when an authenticated, low-privileged user constructs malicious or unauthorized HTTP requests directed toward the vulnerable endpoints of the Internal Operations component within the Oracle Internet Procurement Connector. Because of insufficient access controls, validation checks, or authorization enforcement within the affected component, the application fails to adequately restrict the user's operational boundaries.\nUpon receiving the malicious HTTP payload, the vulnerable component processes the request without properly verifying whether the authenticated user holds the necessary administrative or operational permissions to perform the requested actions. This failure allows the payload to execute successfully against the underlying data structures.\nThe post-exploitation impact includes severe breaches of data confidentiality and integrity. The attacker achieves unauthorized read access to critical data or complete access to all data accessible by the Oracle Internet Procurement Connector. Additionally, the attacker gains unauthorized write, modification, and deletion capabilities over critical or all accessible data stores within the application context. The vulnerability does not affect system availability, as indicated by the CVSS 3.1 vector metrics where availability impact is set to none (A:N), focusing strictly on high impacts to confidentiality (C:H) and integrity (I:H)."
}