The CVE describes an easily exploitable flaw in Oracle General Ledger’s Internal Operations component. A low‑privileged attacker who can reach the application over HTTP can use the flaw to read data that should be protected. The vulnerability is rated with a 6.5 CVSS score driven by confidentiality impact only; integrity and availability are not affected. The exploit allows the attacker to obtain sensitive accounting information and, potentially, all data accessible through the General Ledger environment.

Oracle General Ledger, part of Oracle E‑Business Suite, is affected. Supported installations of version 12.2.3 through 12.2.15 are listed as vulnerable. The issue applies to the general ledger application as a whole; no specific module or add‑on is isolated.

The flaw is reachable over the public network via HTTP and requires only a low‑privileged account to trigger. The CVSS 3.1 base score of 6.5 reflects the ease of exploitation and the confidentiality loss. EPSS data is not available, and the vulnerability is not yet included in the CISA KEV catalog. Attackers would need network access and valid but low‑privileged credentials; no further prerequisites are noted.