The Oracle Application Object Library product is vulnerable to a difficult‑to‑exploit weakness that allows an unauthenticated attacker with network access via HTTP to gain unauthorized creation, deletion, alteration, or access to critical data. The vulnerability can lead to the compromise of all data accessible through the library, affecting both confidentiality and integrity. The CVSS 3.1 Base Score is 6.8, indicating a moderate severity with high impact on confidentiality and integrity.

Oracle Corporation’s Oracle Application Object Library, part of Oracle E‑Business Suite, is affected in versions 12.2.3 through 12.2.15.

Because the attack requires internet exposure to HTTP services and unauthenticated access, the likelihood of exploitation is moderate but dependent on the presence of publicly reachable instances. The CVSS score reflects the potential for significant data impact, and the vulnerability is not flagged in the CISA KEV list. Exploit steps would involve crafting a request that leverages the library’s lack of proper access control, and the attacker may need a secondary human actor to trigger the action, indicating that the risk could be mitigated by limiting public exposure.