A remote low‑privileged attacker that can reach the Oracle Concurrent Processing component via HTTP may read a restricted subset of data exposed by the Concurrent Requests service. The flaw is an information‑exposure weakness that allows read access to data that should be protected, leading to potential confidentiality compromise for the affected information.

The Oracle Concurrent Processing component of Oracle E‑Business Suite, specifically versions 12.2.3 through 12.2.15, is affected. This component processes concurrent requests, and the vulnerability exists in how it handles HTTP‑based requests to expose data to users with low privileges.

The CVSS v3.1 score is 3.1, reflecting a low severity but a confidentiality impact. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Because the attack requires HTTP network access and low‐privilege authentication, the exploitation likelihood is low and would generally be limited to users with valid accounts or access to the internal network. The impact is confined to read access to a subset of data rather than full system compromise.