Document Management And Collaboration
Monthly
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any authenticated low-privileged user with HTTP access, with high confidentiality, integrity and availability impact. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) because the attack is simple, needs no user interaction, and defeats the authorization boundary around the module's internal operations. No public exploit code or CISA KEV entry is identified at time of analysis, but the low privilege bar combined with broad enterprise EBS deployment makes this a patch-now item.
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP. Successful exploitation grants complete control over the module's confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker can read, alter, or destroy managed documents and related business data. There is no CISA KEV listing, no public exploit code, and no EPSS data in the provided intelligence, so this is currently a patch-priority issue for Oracle E-Business Suite shops rather than a confirmed actively exploited threat.
Unauthenticated attackers with network access to the HTTP service can fully compromise Oracle Document Management and Collaboration (the Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete loss of confidentiality, integrity and availability - CVSS 3.1 base score 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication bypass (CWE-287), meaning no credentials, user interaction or non-default configuration are required; the only prerequisite is that the affected HTTP endpoint be reachable by the attacker, so internet-facing or broadly exposed EBS deployments carry the highest realistic risk. At time of analysis there is no confirmed active exploitation (CISA SSVC exploitation value: none) and no public exploit identified at time of analysis; CISA's SSVC assessment rates the vulnerability as automatable with total technical impact.
Unauthorized data access and partial denial of service in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) allows a remote unauthenticated attacker to read, insert, update, or delete a subset of application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, the flaw is rated CVSS 7.3 and is described by Oracle as easily exploitable, requiring no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector makes it a meaningful patching priority in a product family that has been a repeated target of mass-exploitation campaigns.
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Document Management). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any authenticated low-privileged user with HTTP access, with high confidentiality, integrity and availability impact. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) because the attack is simple, needs no user interaction, and defeats the authorization boundary around the module's internal operations. No public exploit code or CISA KEV entry is identified at time of analysis, but the low privilege bar combined with broad enterprise EBS deployment makes this a patch-now item.
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP. Successful exploitation grants complete control over the module's confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker can read, alter, or destroy managed documents and related business data. There is no CISA KEV listing, no public exploit code, and no EPSS data in the provided intelligence, so this is currently a patch-priority issue for Oracle E-Business Suite shops rather than a confirmed actively exploited threat.
Unauthenticated attackers with network access to the HTTP service can fully compromise Oracle Document Management and Collaboration (the Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete loss of confidentiality, integrity and availability - CVSS 3.1 base score 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication bypass (CWE-287), meaning no credentials, user interaction or non-default configuration are required; the only prerequisite is that the affected HTTP endpoint be reachable by the attacker, so internet-facing or broadly exposed EBS deployments carry the highest realistic risk. At time of analysis there is no confirmed active exploitation (CISA SSVC exploitation value: none) and no public exploit identified at time of analysis; CISA's SSVC assessment rates the vulnerability as automatable with total technical impact.
Unauthorized data access and partial denial of service in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) allows a remote unauthenticated attacker to read, insert, update, or delete a subset of application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, the flaw is rated CVSS 7.3 and is described by Oracle as easily exploitable, requiring no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector makes it a meaningful patching priority in a product family that has been a repeated target of mass-exploitation campaigns.
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Document Management). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.