## Summary
A vulnerability in Oracle Product Hub (Oracle E-Business Suite, component: Item Catalog) affects supported versions 12.2.3 through 12.2.15. It is described as easily exploitable by a low-privileged attacker with network access via HTTP, potentially enabling unauthorized access to critical data or complete access to all Oracle Product Hub accessible data.
## Technical Details
- Affected component: Item Catalog within Oracle Product Hub.
- Attack vector: NETWORK over HTTP.
- Attacker privileges required: PR:L (low privileges).
- User interaction: UI:N (none).
- Impact scope: S:C (scope changed), meaning compromise may extend beyond Oracle Product Hub to additional Oracle products.
## Affected
- Oracle E-Business Suite — Oracle Product Hub — Item Catalog
- Supported affected versions: 12.2.3 to 12.2.15.
## Impact
- Unauthorized access to critical data in Oracle Product Hub.
- Potential complete access to all Oracle Product Hub accessible data.
- Confidentiality impact is primary (C:H), with no integrity or availability impact indicated (I:N, A:N).
- Significant impact to additional products is possible due to scope change (S:C).
## Mitigation
1. Apply the vendor’s security patch/update for Oracle E-Business Suite / Oracle Product Hub (Item Catalog) covering the affected version range 12.2.3–12.2.15.
2. Restrict network access to the Oracle Product Hub HTTP endpoints to only trusted sources (e.g., via firewall/VPN allowlists).
3. Reduce privileges of accounts that can reach the vulnerable surface to limit the practical effect of PR:L requirements.
4. Monitor for anomalous access patterns to Oracle Product Hub resources from network locations that do not match expected client behavior.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N