A vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to data or, in worse cases, all accessible data. The flaw exploits improper access control, resulting in confidentiality loss without affecting integrity or availability. The CVSS 3.1 base score of 7.5 reflects the high impact on confidentiality when the attacker leverages an exposed web interface.

All Oracle Application Object Library installations in Oracle E-Business Suite versions 12.2.3 through 12.2.15 are vulnerable. The affected product is the Core component of Oracle Application Object Library, as indicated by the vendor/product mapping in the CNA data.

The CVSS score of 7.5 indicates a serious security risk, but the EPSS score of less than 1% suggests a low likelihood of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed public exploitation instances have been reported. The attack vector is a network-based HTTP request that can be sent from any host without authentication. Successful exploitation can provide attackers with read access to sensitive data stored within the Oracle Application Object Library. Without a patch or workaround, the risk remains significant for organizations that expose the affected application to the Internet or untrusted networks.