The flaw resides in the SQR component of Oracle PeopleSoft Enterprise PeopleTools and allows a low‑privileged user who has logged onto the host system to read data that should be restricted. No code execution, privilege escalation, or availability impact is possible; the vulnerability is a pure read‑out flaw that can expose sensitive information. The CVSS v3.1 score of 2.5 reflects this limited confidentiality effect.

Oracle PeopleSoft Enterprise PeopleTools, specifically the SQR component, is affected for all releases 8.61 through 8.63. No other versions or components are included in the advisory.

The CVSS Base score of 2.5 categorized the vulnerability as low severity. The attack vector is local (AV:L), with high attack complexity (AC:H) and a low privilege requirement (PR:L). Because it requires physical or local system access, remote attackers cannot exploit it without first compromising the host or obtaining local credentials. The EPSS score is reported as < 1%, indicating a very low probability of exploitation, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.