The vulnerability resides in Oracle Marketing’s Audience component and permits a low-privileged attacker with network access via HTTP to gain unauthorized read, insert, or delete access to data that the attacker is not normally allowed to modify. This leads to confidentiality and integrity impacts as the attacker can read sensitive customer data or alter it. The exploit requires an additional human‑initiated interaction, so the attacker must convince or co‑operate with another individual for the attack to succeed. The vulnerability’s scope changes, meaning successful exploitation could have cascading effects on other Oracle products beyond Marketing. The official CVSS 3.1 vector indicates a medium‑severity base score of 5.4 with low attack complexity, low privileges, and required user interaction.

Oracle Marketing (Oracle E‑Business Suite Audience component) versions 12.2.3 through 12.2.15 are affected. The impact applies to all installations within this version range, regardless of deployment environment, as the flaw is exposed over HTTP.

The CVSS Base Score of 5.4 highlights moderate risk with confidentiality and integrity concerns. EPSS is not available, so the likelihood of exploitation cannot be quantified at this time, but the vulnerability is listed outside CISA’s KEV catalog. The likely attack vector is network‑based HTTP access, requiring the attacker to conduct a socially engineered interaction with a separate user to achieve exploitation. Because the scope changes, successful exploitation can potentially compromise additional Oracle products in the same environment.