## Summary
A vulnerability in Oracle Bills of Material (Oracle E-Business Suite component: Internal Operations) affects supported versions 12.2.3 through 12.2.15. It is described as easily exploitable by a low-privileged attacker with network access via HTTP, enabling unauthorized creation, deletion, or modification of critical data and/or access to all Bills of Material accessible data.
## Technical Details
- Affected component: Internal Operations within Oracle Bills of Material.
- Attack vector: HTTP over the network (AV:N).
- Privileges required: PR:L (low privileged attacker).
- User interaction: UI:N (no user interaction required).
- Impact scope: S:U (unchanged scope).
- CVSS 3.1: 8.1 with C:H and I:H impacts; A:N (availability not impacted per NVD).
## Affected
- Oracle Bills of Material (Oracle E-Business Suite component: Internal Operations): 12.2.3–12.2.15.
## Impact
- Unauthorized creation, deletion, or modification of critical data.
- Unauthorized access to critical data or complete access to all Oracle Bills of Material accessible data.
## Mitigation
1. Patch immediately to the vendor-fixed version for Oracle E-Business Suite / Oracle Bills of Material Internal Operations (exact fixed version not provided in the available data).
2. Restrict network access to the affected HTTP endpoints so only trusted clients can reach Oracle Bills of Material.
3. Review and tighten access controls for low-privileged roles that could reach the vulnerable functionality.
4. Monitor for anomalous Bills of Material data changes (creation/deletion/modification) originating from network clients associated with low-privileged accounts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N