This vulnerability resides in the PO View Document component of Oracle Purchasing for Oracle E‑Business Suite. An attacker with low privileges who can reach the service over HTTP can read purchase order information that the application treats as confidential. The flaw is an improper access control issue (CWE-284), allowing unauthorized disclosure of data and resulting in a compromise of data confidentiality, though it does not affect integrity or availability. The CVSS v3.1 base score of 6.5 reflects this confidentiality impact and the fact that the flaw is exploitable from a network perspective with authenticated privileges that are limited to a low level of access.

The affected product is Oracle Purchasing, part of Oracle E‑Business Suite. Versions from 12.2.3 through 12.2.15 are impacted. The vulnerability is specific to the PO View Document feature and does not apply to other components of the suite.

The flaw has a CVSS score of 6.5 but no EPSS value is available and it is not listed in the CISA KEV catalog. The likely attack vector is a network‑based attack over HTTP, requiring only low privileges. Because the exploitation pathway does not necessitate complexity or elevated privileges, the risk to environments that expose Oracle Purchasing to external or untrusted networks remains significant, warranting prompt remedial action.