The vulnerability exists in the Requisition Management component of Oracle iProcurement versions 12.2.3 through 12.2.15. It permits an attacker with low privileges who can reach the application over HTTP to compromise the iProcurement system. If successfully exploited, the attacker can take full control of the application, resulting in loss of confidentiality, integrity, and availability for the affected system.

Oracle Corporation iProcurement product, versions 12.2.3 to 12.2.15.

The CVSS v3.1 base score is 7.5, indicating high severity. An EPSS score is not available, so the current probability of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog, and no official workaround is provided. Based on the description, the likely attack vector is over the network through HTTP, requiring only low privileges on the target system. Once inside, the attacker can fully compromise iProcurement, though specific exploit steps are not detailed.