A vulnerability in the Diagnostics component of Oracle Applications Manager allows an attacker who holds high privileges and can reach the instance via HTTP to read a subset of the application’s data. The weakness is a low‑impact confidentiality issue, as the attacker can access only limited information without affecting integrity or availability. The CVSS 3.1 base score is 2.2, reflecting the modest but non‑negligible information disclosure potential.

Oracle Applications Manager, part of Oracle E‑Business Suite, is affected for versions 12.2.3 through 12.2.15. Only these releases contain the vulnerable diagnostics code; earlier or newer versions are not impacted.

The CVSS score of 2.2 indicates a low‑severity risk, and the EPSS score is not available, so it is unclear how frequently the vulnerability is exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have high‑privilege credentials and network reach to the HTTP interface of the Diagnostics component, implying that the attack surface is limited to users with strong authentication. Once exploited, the attacker can read restricted application data, potentially exposing confidential information to individuals who should not have that level of access.