This vulnerability arises from improper access control in the Outcome‑Result component of Oracle Customer Interaction History. With low privilege, an attacker who can reach the application over HTTP can read protected data. The flaw allows a reader to disclose confidential customer interaction records, representing a high confidentiality impact and no impact on integrity or availability.

Oracle Customer Interaction History in Oracle E‑Business Suite versions 12.2.3 through 12.2.15 is affected. The issue is confined to the Outcome‑Result component, but the scope flag indicates that successfully exploiting the weakness could affect additional Oracle E‑Business Suite products that access or rely on Customer Interaction History data.

The CVSS 3.1 base score of 7.7 classifies this as a high severity vulnerability. The EPSS score of < 1% shows a low probability of exploitation at the current time, and the issue is not listed in the CISA KEV catalog. An attacker requires network access and basic HTTP knowledge; no elevated privileges or local access are needed. Successful exploitation would enable the attacker to retrieve all customer interaction history data indexed by the application.