Oracle E-Business Suite Payments flaw under attack

Exploit targets ibytransmit endpoint, reads /etc/passwd via DeliveryRequest XML. Same technique could reach DB credentials and payment API keys. Admins should restrict EBS web interfaces from public internet.