Oracle Purchasing in Oracle E-Business Suite is vulnerable to a low-privileged attacker who can use network access over HTTP to compromise the system. The CVSS 3.1 base score of 8.8 reflects significant confidentiality, integrity, and availability impacts, indicating that an attacker can effectively take over the application. This vulnerability permits full control of Oracle Purchasing, allowing the attacker to read, modify, delete, or execute arbitrary operations affecting business processes.

The affected product is Oracle Purchasing for Oracle E-Business Suite, with impacted versions ranging from 12.2.3 through 12.2.15. No other Oracle E-Business Suite components are listed as affected in the advisory.

The high CVSS score signals a severe risk, though the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Inferred from the description, the attack vector is remote network access over HTTP, requiring only low privileged credentials. The vulnerability is likely exploitable by an attacker with limited access rights, which lowers the bar for potential attackers compared to requiring high privileges. Given these factors, the risk of exploitation remains substantial until a patch is applied.