## Summary
Oracle Project Intelligence (Oracle E-Business Suite, component: Internal Operations) contains a vulnerability affecting versions 12.2.3 through 12.2.15. The issue is described as easily exploitable by a low-privileged attacker with network access via HTTP, enabling compromise of Oracle Project Intelligence data.
## Technical Details
- Attack vector: NETWORK via HTTP.
- Privileges required: PR:L (low privileges).
- User interaction: UI:N (none).
- Impact scope: S:U (unchanged scope).
- The NVD description indicates the attacker can achieve:
- Unauthorized creation, deletion, or modification of critical data or all Oracle Project Intelligence accessible data.
- Unauthorized read access to a subset of Oracle Project Intelligence accessible data.
## Affected
- Oracle E-Business Suite — Oracle Project Intelligence (Internal Operations component)
- Affected versions: 12.2.3 to 12.2.15.
## Impact
- Confidentiality impact: C:L (low)
- Integrity impact: I:H (high)
- Availability impact: A:N (none)
- Overall CVSS: 7.1 (CVSS 3.1)
## Mitigation
1. Restrict HTTP network access to Oracle Project Intelligence to only trusted sources (e.g., allowlist at the network layer).
2. Ensure affected Oracle E-Business Suite installations (12.2.3–12.2.15) are reviewed and updated according to Oracle guidance for Internal Operations / Oracle Project Intelligence.
3. Monitor for anomalous data operations (unexpected create/delete/modify actions and unusual read patterns) originating from low-privileged accounts or from unexpected client hosts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N