A vulnerability in the Product Diagnostic Tools component of Oracle Order Management enables a low-privileged attacker with network access over HTTP to read information that should be protected. The weakness is a CWE-200 sensitive data exposure. When successfully exploited, the attacker can access critical data or obtain full visibility of all Order Management‑accessible data, potentially compromising other Oracle applications that share session context.

Oracle Order Management product of Oracle E‑Business Suite, versions 12.2.5 through 12.2.15, is affected. The flaw may also extend its impact to other Oracle applications that share the same session context. Network traffic to HTTP endpoints in these installations is required for exploitation.

The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity. The EPSS score is below 1 %, reflecting a very low probability of exploitation in the wild, and it is not listed in CISA’s KEV catalog. The attack vector is network‑based over HTTP and only requires low privileges, so an attacker can easily gain unauthorized access to data. Because the scope can change, the compromise can spread to other Oracle applications, amplifying the overall risk.