This vulnerability in Oracle Applications Manager’s Diagnostics Interfaces allows an attacker who is only low privileged and able to reach the application over HTTP to compromise the system. The flaw permits unauthorized access to critical data or full access to all data exposed by Oracle Applications Manager. The weakness is a classic access‑control problem that can lead to confidentiality loss in the absence of proper authentication or authorization checks.

Affected versions of Oracle Applications Manager under Oracle E‑Business Suite, specifically 12.2.3 through 12.2.15, are impacted by this issue. These versions run the Diagnostics Interfaces component, which is the component vulnerable to exploitation.

The reported CVSS 3.1 base score is 6.5, indicating a moderate severity with mainly confidentiality impacts. No EPSS score is available, so the current exploitation probability is not quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a low‑privileged user with network access via HTTP, meaning that external network exposure of the Oracle Applications Manager interface significantly raises the risk. An attacker could gain unauthorized data access without prior authentication or with bypassed authorization checks, exploiting the described weakness.