A vulnerability exists in the Product Diagnostic Tools component of Oracle E‑Business Suite Order Management, allowing an attacker who can access the system over HTTP to read or potentially modify confidential data. The flaw is exploitable by a low‑privileged user and can lead to the exposure of all information accessible through Order Management. This weakness intersects with improper access control, as the diagnostic interface does not enforce appropriate authorization boundaries, resulting in a direct confidentiality compromise and a potential denial of further protective controls.

Oracle Corporation’s Order Management product, versions 12.2.3 through 12.2.15, is affected. The issue impacts all deployments of this component within the specified version range, regardless of additional configuration settings. Operating environments that expose the diagnostic services over HTTP are at particular risk.

The CVSS score of 6.5 reflects a moderate severity with high confidentiality impact, low technical complexity, and the requirement of only low privileged access. There is no EPSS score for this item, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Likely, an attacker would need network visibility to the HTTP end‑points and would then utilize the exposed diagnostic API to retrieve sensitive data. The absence of authentication controls or role checks on the diagnostic tools enables the attacker to bypass normal access restrictions.