## Summary
Oracle Sales Offline (Oracle E-Business Suite, component: Internal Operations) contains a network-accessible vulnerability affecting supported versions 12.2.3 through 12.2.15. The issue is described as easily exploitable by a low-privileged attacker with HTTP network access, potentially leading to unauthorized access to critical data or complete access to all Oracle Sales Offline accessible data.
## Technical Details
- Affected component: Internal Operations within Oracle Sales Offline.
- Attack vector: NETWORK via HTTP.
- Privileges required: low privileged attacker (per NVD).
- User interaction: none (per NVD).
- Impact scope: S:C (changed scope), indicating compromise may extend beyond the vulnerable component.
- Resulting impact: C:H (high confidentiality impact) with I:N and A:N (no integrity/availability impact stated in NVD).
## Affected
- Oracle E-Business Suite — Oracle Sales Offline (Internal Operations)
- Versions: 12.2.3 to 12.2.15 (inclusive)
## Impact
- Unauthorized access to critical data and/or complete access to all Oracle Sales Offline accessible data.
- Potentially significant impact on additional Oracle products due to scope change.
## Mitigation
1. Patch/upgrade Oracle Sales Offline to a fixed version as provided by Oracle (no reference content was available here to identify the exact fixed release).
2. Restrict network access to the Oracle Sales Offline HTTP endpoints to only trusted clients/segments.
3. Review and harden access controls for low-privileged accounts that can reach the service over HTTP.
4. Monitor for anomalous HTTP requests and unusual data access patterns consistent with unauthorized retrieval of Sales Offline data.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N