A flaw in the Internal Operations component of Oracle Purchasing allows a low‑privileged attacker who can reach the system over HTTP to compromise the application. Successful exploitation yields unauthorized read access to critical data and the ability to update, insert, or delete data that the attacker is already able to view. The vulnerability also introduces a scope change that could enable an attacker to impact additional Oracle E‑Business Suite products. The CVSS 3.1 base score of 7.1 reflects moderate to high confidentiality impact and low integrity impact for the compromised data. The attack path remains difficult in practice, requiring network access and exploitation of an internal logic flaw.

Impact is confined to the Oracle Purchasing application of Oracle E‑Business Suite. Versions 12.2.3 through 12.2.15 are explicitly affected. No other versions or components are listed as vulnerable.

The CVSS score of 7.1 indicates a serious threat. Because the EPSS score is unavailable, the probability of exploitation from current data cannot be quantified, though the categorization as a difficult-to-exploit vulnerability suggests lower prevalence. The vulnerability is not currently listed in CISA KEV. Externally reachable HTTP traffic to the application is the likely attack vector, and an attacker with low privileges may still obtain significant read and modify capabilities. The scope expansion implies that exploitation of Oracle Purchasing could also provide a stepping stone to other related Oracle products.