There is a flaw in the Security component of Oracle Applications Framework that permits an unauthenticated attacker to access confidential data via the web interface. The attacker can reach the vulnerable component over HTTP and, with the participation of a third‑party user, trigger the vulnerability to read or download data exposed by the framework. The vulnerability does not affect integrity or availability; its primary impact is the disclosure of sensitive information.

Oracle Corporation’s Oracle Applications Framework product, part of Oracle E‑Business Suite, is affected. Versions from 12.2.3 through 12.2.15 are listed as vulnerable. An attacker needs network access to the framework over HTTP to reach the vulnerable code.

The CVSS 3.1 base score of 6.5 classifies this issue as moderate severity, and the EPSS score is lower than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires a human other than the attacker to initiate the action, which limits the likelihood of automated attacks. The attack vector is network‑based via HTTP; thus, exposure through publicly reachable interfaces increases risk.