Oracle Internet Procurement Connector versions 12.2.3 through 12.2.15 contain a flaw that allows a low‑privileged attacker with network access via HTTP to take control of the application. The vulnerability can enable the attacker to create, delete, or modify critical data and to retrieve all data accessible by the connector. The impact is a loss of confidentiality and integrity of data handled by the product. Based on the description, the likely attack vector is the exposed HTTP interface, with the attacker only needing lower‑level network privileges and no special authentication. This is an easily exploitable weakness that grants broad data‑handling capabilities without proper authorization.

Oracle Corporation’s Internet Procurement Connector, versions 12.2.3 to 12.2.15 inclusive. No other product versions or vendors are listed as affected.

The CVSS 3.1 base score of 8.1 indicates a high severity vulnerability, primarily due to significant confidentiality and integrity impacts while availability is unaffected. EPSS data is not available, so the exact likelihood of exploitation cannot be quantified, but the lack of a KEV listing does not reduce the risk posed by the high CVSS score. An attacker only needs network access and low privileges, making it a realistic threat for organizations exposing the connector to internal or external networks.