A flaw in Oracle Project Contracts allows a low‑privileged attacker who can reach the system over HTTP to gain unauthorized access to critical data. The vulnerability enables the attacker to read or retrieve all data that the application can access, effectively compromising the confidentiality of the Project Contracts database. The flaw is considered exploitable with minimal effort and no elevated privileges are required beyond network-level access.

The affected product is Oracle Project Contracts, part of Oracle E‑Business Suite, in the versions 12.2.3 through 12.2.15 inclusive. No other Oracle product is explicitly listed as affected, but the vulnerability may impact additional products that rely on Project Contracts due to a scope change.

The CVSS 3.1 base score of 7.7 indicates a high severity. Because the attack vector is network‑based (HTTP) and the privilege requirement is low, the exploitation risk is significant. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the high CVSS score and the fact that it can expose all Project Contracts data warrant urgent remediation. The likely attack path involves an attacker sending crafted HTTP requests to the vulnerable instance to harvest sensitive information.