Oracle E-Business Suite iStore Shopping Cart Vulnerability Allowing Unauthorized Data Access and Modification

A vulnerability has been identified in the Oracle iStore component of Oracle E-Business Suite, specifically in versions 12.2.5 through 12.2.14. This vulnerability, which resides in the Shopping Cart feature, is easily exploitable by an unauthenticated attacker with network access via HTTP. Successful exploitation requires human interaction from a third party. While the vulnerability is contained within Oracle iStore, its effects could extend to other products, leading to a scope change. Exploitation of this vulnerability could result in unauthorized read, update, insert, or delete access to certain data accessible through Oracle iStore.

Impact

Exploitation of this vulnerability could allow for unauthorized read, update, insert, or delete access to some data accessible through Oracle iStore.