## Summary
Oracle XML Gateway (Oracle E-Business Suite component: Install) contains a network-accessible vulnerability affecting versions 12.2.3 through 12.2.15. An attacker with low privileges can exploit it over HTTP to gain unauthorized access to Oracle XML Gateway accessible data and potentially cause a partial denial of service.
## Technical Details
- Attack vector is HTTP over the network (AV:N).
- Exploitation requires low privileged access (PR:L) and no user interaction (UI:N).
- The impact includes high confidentiality impact (C:H) and partial availability impact (A:L), with integrity impact reported as none (I:N).
## Affected
- Oracle E-Business Suite — Oracle XML Gateway (component: Install)
- Affected versions: 12.2.3 to 12.2.15
## Impact
- Unauthorized access to critical data and/or complete access to data accessible via Oracle XML Gateway.
- Partial denial of service (partial DoS) of Oracle XML Gateway.
## Mitigation
1. Patch immediately to a vendor-fixed release for Oracle XML Gateway / the affected Install component.
2. Restrict network access to Oracle XML Gateway over HTTP (e.g., allowlist only required clients/segments).
3. Review and harden the exposure of Oracle E-Business Suite components that provide access to Oracle XML Gateway, ensuring least-privilege for any accounts that can reach it.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L