A vulnerability in the Oracle E‑Business Suite Installed Base component’s HTML UI allows an unauthenticated attacker who can reach the service via HTTP to compromise the application. The flaw requires a human interaction from a user other than the attacker, indicating that the attacker must rely on social engineering or a prompted action to trigger the exploit. Successful exploitation permits the attacker to update, insert, or delete data stored in the Installed Base and to read a subset of that data, thereby impacting confidentiality and integrity without affecting availability.

Oracle Corporation’s Installed Base component of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, is affected when the HTML UI is enabled. Users of these versions who are reachable via HTTP are at risk, and the vulnerability’s scope change could extend impacts to additional products within the suite.

The CVSS v3.1 score of 6.1 reflects moderate severity, low attack complexity, no privilege or user interaction required beyond a human action, and an impact on confidentiality and integrity. The EPSS score is below 1 %, indicating that the likelihood of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is network‑based HTTP access, and an attacker must rely on a target user to perform an action that activates the flaw.