Technical impact
The Oracle Product Hub component of Oracle E‑Business Suite is vulnerable to a flaw that allows an attacker with low privileges and standard network access to HTTP to bypass authorization controls and read or retrieve all data that the product exposes. The vulnerability enables the compromise of confidentiality, as the attacker can view or export sensitive information that was otherwise protected by the system’s access controls. Based on the description, it is inferred that this flaw is an access‑control weakness that compromises data confidentiality.
Affected Systems
Oracle Corporation’s Oracle Product Hub is affected. The vulnerable range includes all supported versions from 12.2.3 through 12.2.15. Users running these releases should verify their environment against this version band.
Risk and Exploitability
The vulnerability is scored as a high severity with a CVSS 3.1 base score of 7.7. The EPSS indicates that the likelihood of exploitation is very low (<1%), and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is local network HTTP with no user interaction, which can be deployed from any location with network connectivity to the exposed service. The attack does not require privileged credentials and benefits from a scope change, meaning the attacker can potentially gain access to additional components beyond the Product Hub once the exploit is successful.
