The Oracle Applications Manager product of Oracle E‑Business Suite contains a vulnerability in its Diagnostics component. A high‑privileged attacker who can reach the service over HTTP can exploit the flaw. The vulnerability permits unauthorized read of a subset of data stored by Oracle Applications Manager and can cause a partial denial of service. The weakness aligns with CWE‑200 (Information Exposure) and CWE‑284 (Access Control). The impact is limited to confidentiality and availability; integrity is not affected.

The affected environment is Oracle Applications Manager (Oracle E‑Business Suite, Diagnostics). Versions 12.2.3 through 12.2.15 are susceptible. No later versions are known to have the flaw.

The CVSS base score is 3.3, indicating low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. An attacker would need network access to the HTTP interface and high privileges, with no user interaction required. The vector is Network, Attack Complexity High, Privileges Required High, user interaction not required, scope unchanged, low confidentiality and availability impact. Because of the low CVSS score and lack of public exploits, the practical risk is modest, but authentication bypass may still allow compromised applications to leak sensitive data.