A flaw in the Oracle Configurator user interface allows an attacker with network connectivity via HTTP to read a subset of data without authentication. The vulnerability can be exploited easily by an unauthenticated adversary, leading to confidential information disclosure. The weakness is rooted in improper access control that permits data reads that should be protected.

Oracle Configurator, part of Oracle E-Business Suite, affects all supported versions from 12.2.3 to 12.2.15. These versions are distributed by Oracle Corporation.

The CVSS 3.1 score of 5.3 indicates a moderate severity with a low confidentiality impact. The EPSS score of less than 1% suggests that exploitation may be uncommon, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the attack vector is inferred to be unauthenticated HTTP traffic, requiring only network access to the Configurator service. A skilled attacker can gain read access to protected data without additional credentials, making the exploitation path straightforward.