An unauthenticated remote access flaw exists in the Oracle Scripting component of Oracle E‑Business Suite, allowing an attacker who can reach the service over HTTP to read data that should be protected. No authentication or user interaction is required, and the vulnerability permits full read‑only access to all data exposed through the scripting interface. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) illustrates that the sole risk is to confidentiality.

Oracle Corporation’s Oracle Scripting product, part of the Internal Operations module of Oracle E‑Business Suite, is affected. Versions 12.2.3 through 12.2.15 are vulnerable; no other products or releases are listed as impacted.

With a CVSS base score of 7.5, the vulnerability poses a significant confidentiality risk. Although EPSS score is less than 1%, indicating a very low exploitation probability, and the issue is not currently listed in CISA KEV, the ease of exploitation over a public or internal HTTP endpoint makes it a realistic threat. An attacker can simply send specially crafted HTTP requests without credentials to retrieve sensitive data, making the attack surface broad and low‑effort.