Oracle Financials Common Modules has a vulnerability that allows a low‑privileged attacker with network access over HTTP to gain unauthorized access to critical data or full access to all data exposed by the modules. The CVSS vector indicates a high impact on confidentiality and no impact on integrity or availability. The identified weaknesses are listed as CWE-284 (Improper Access Control) and CWE-200 (Information Exposure).

Affected are Oracle E‑Business Suite Financials Common Modules versions 12.2.3 through 12.2.15. Users running any of these releases expose the modules to the described exploitation path via HTTP endpoints.

The CVSS score of 7.7 indicates a high severity. The EPSS score is not available, so precise exploitation probability remains unknown, but the description indicates the vulnerability is easily exploitable. The vulnerability is not listed in the CISA KEV catalog. Based on the vector, the likely attack path involves a remote attacker sending HTTP requests that exploit the flaw, allowing a low‑privileged attacker to access critical data exposed by the modules.