A flaw in the Data Provider UI component of Oracle Installed Base lets an attacker with low privileges who can reach the service over HTTP read critical data, gain complete access to any data available through Installed Base, or inject, update, or delete that data. The vulnerability is rated CVSS 3.1 score 7.1, indicating severe confidentiality impact and low integrity impact, with no availability impact. The issue stems from insufficiently protected access‑control checks in the UI component that allow a low‑privileged attacker to perform actions normally reserved for higher‑privileged users.

Oracle Corporation Installed Base product of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, which includes the Data Provider UI component.

The low attack effort and network‑based attack vector mean that an attacker who has network access to the Oracle Web service can exploit the flaw by sending crafted HTTP requests. The EPSS score is 0.0023 (<1%), indicating a very low exploitation probability, while the CVSS score of 7.1 and lack of availability impact still suggest a moderate‑to‑high risk level. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been reported, yet the escalation potential of improper authorizations encourages prompt patching once a vendor update is available.