A vulnerability in Oracle General Ledger permits a low‑privileged attacker with HTTP access to bypass internal access controls, allowing unauthorized creation, deletion or modification of critical data, unauthorized read of a subset of data, and the ability to repeatedly cause a hang or crash. This results in confidentiality loss for some data, integrity loss for all accessible data, and application availability loss, reflected in the CVSS‑3.1 base score of 7.1.

Oracle General Ledger, part of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, specifically the Internal Operations component.

The known attack vector is a low‑privileged network user who can reach the server over HTTP. While the CVE description specifies the need for a user with limited privileges, it does not explain how the attacker obtains such credentials, so it is inferred that credential compromise or social engineering may be necessary. The CVSS score of 7.1 indicates high severity, and the EPSS score of <1% shows an extremely low current probability of exploitation; the vulnerability is not included in the CISA KEV catalogue, implying no publicly known active attacks. Nonetheless, legitimate users with insufficient privileges expose the system to a persistent internal threat.