A flaw in the Documents component of Oracle One-to-One Fulfillment allows an attacker with low privileges and network access via HTTP to gain unauthorized access to critical data. The issue is exploitable without authentication beyond a low-privilege account and can lead to confidentiality compromise. The CVSS v3.1 score of 6.5 reflects moderate severity focused on high confidentiality impact while integrity and availability remain unaffected.

Oracle Corporation’s Oracle One-to-One Fulfillment product within Oracle E-Business Suite is affected. Supported version ranges include 12.2.3 through 12.2.15. Individuals deploying any of these releases should verify their version compliance.

The CVSS score of 6.5 indicates a moderate risk level, yet the vulnerability is easily exploitable; an attacker only needs low-level permissions and simple HTTP connectivity to target the application. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of active protection mechanisms makes it plausible that attacks could occur early. Exploitation does not require elevated privileges or complex setup, making it a realistic threat for organizations that expose the service to external networks.