A vulnerability in Oracle Global Order Promising allows a low‑privileged attacker with network access via HTTP to create, delete or modify critical data and to gain unauthorized access to all accessible data. The flaw is difficult to exploit, but once exploited the attacker can potentially change the access scope of the application, leading to significant confidentiality and integrity impacts.

Oracle Global Order Promising product of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15 inclusive.

The CVSS 3.1 score of 8.2 indicates a high severity with Confidentiality and Integrity impacts. With no EPSS score available, the exploitation probability is unknown, but the vulnerability is listed as not in the CISA KEV catalog. The attack vector is inferred to be HTTP traffic, and the low privileged attacker requirement suggests that compromised network hosts could trigger the exploit. Inference: The attacker must generate a specific request to the vulnerable web service endpoint to trigger the unauthorized data modification.