Oracle Advanced Outbound Telephony, part of Oracle E‑Business Suite, contains a flaw that permits a low‑privileged attacker with network access via HTTP to perform unauthorized updates, inserts, or deletions of data and read restricted data. Based on the description, it is inferred that the application lacks proper access controls for these operations, allowing the attacker to act on behalf of a legitimate user. The flaw requires a secondary user to provide interaction, meaning the attacker must convince another person to initiate the action.

The affected product is Oracle Advanced Outbound Telephony in Oracle E‑Business Suite, supported versions 12.2.3 through 12.2.15. The vulnerability is confined to this component, but the scope change (S:C) indicates that exploitation may impact additional Oracle products that share data or components.

The CVSS v3.1 base score of 5.4 classifies the vulnerability as medium severity, with confidentiality and integrity impacts but no availability impact. Exploitation requires a low‑privileged attacker with HTTP network access and the cooperation of another user, so the practical likelihood is moderate but not negligible. No EPSS data is available and the issue is not listed in the CISA KEV catalog, implying no known public exploits. The scope change suggests that the damage could extend beyond the initial component, increasing the potential business impact.