Oracle Configurator allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on data that the configurator can access, and to read a subset of that data. The vulnerability stems from improper access control in the User Interface component, enabling actions normally reserved for authenticated users. This weakness can lead to integrity and confidentiality breaches within the affected applications. Based on the description, it is inferred that the root cause is improper access control in the User Interface component, although the official description does not explicitly state this.

The flaw affects Oracle Configurator versions 12.2.3 through 12.2.15. A user of Oracle E‑Business Suite relying on these configurations is exposed.

The CVSS v3.1 base score of 6.1 reflects moderate severity with low confidentiality and integrity impact on the target system. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Attacks require network connectivity to the configurator’s HTTP endpoint and the presence of a human actor other than the attacker to accept or act upon the changes. Given that the attack can modify or expose data, the threat remains significant for organizations using these versions. The requirement of a human actor other than the attacker is inferred from the stated need for human interaction in successful attacks.