Executive brief
Oracle Web Applications Desktop Integrator is a tool in Oracle E-Business Suite that allows users to download and manage files through a web interface. A vulnerability in its file download component allows attackers with low-level user credentials to bypass security controls and access sensitive data they should not have permission to view. Successful exploitation could expose critical business data or allow complete access to files stored within the system.
Technical details
This is an authorization bypass or access control vulnerability in the file download component of Oracle Web Applications Desktop Integrator. The flaw is easily exploitable, requiring only a low-privileged user account and network access via HTTPS; no special user interaction or additional preconditions are needed. An authenticated attacker can leverage this vulnerability to gain unauthorized access to critical data or complete access to all files accessible through the application. The scope is marked as changed, indicating that while the vulnerability exists in Desktop Integrator, successful exploitation can impact other Oracle E-Business Suite components. A patch is assumed to be available through Oracle's standard security update process.
Affected products
- Oracle E-Business Suite Web Applications Desktop Integrator 12.2.3 to 12.2.15
Timeline
- 2026-09-15: disclosed