There is a vulnerability in the Oracle Order Management component of the Product Diagnostic Tools that allows a low‑privileged attacker who can reach the system over HTTP to read critical data. The flaw provides unauthorized disclosure of information, enabling the attacker to acquire all data the Order Management application makes available, thereby affecting the confidentiality of the organization’s transactional data but not its integrity or availability. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects that the required attacker privileges are low and the user interface is not required. The vulnerability is not a denial‑of‑service or destructive bug; its primary impact is information exposure.

Oracle Order Management for Oracle E‑Business Suite is impacted in all supported releases from version 12.2.3 through 12.2.15. The flaw resides in the Product Diagnostic Tools component and is referenced by the CPE string cpe:2.3:a:oracle:order_management:*:*:*:*:*:*:*:*.

The CVSS score of 6.5 indicates a moderate severity with a clear confidentiality impact. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, but the public advisory suggests the flaw is easily exploitable via standard HTTP requests. Attackers with network access to the Order Management instance can directly trigger the exploit without needing additional tools or elevated privileges. The risk to organizations that expose Order Management over the public network or to untrusted users is therefore significant, especially if sensitive business data is stored in that instance.