The vulnerability exists in Oracle Payroll's internal operations component, permitting an attacker with only low-level network access over HTTP to acquire unauthorized access to critical payroll data. This results in a confidentiality breach, allowing the attacker to read or obtain any data within the Payroll system. The weakness is modeled as an improper authorization issue that is easily exploitable and does not require any authentication beyond the basic network access. Successful exploitation can expose sensitive employee and financial information without impacting integrity or availability.

Oracle Corporation's Oracle Payroll product, versions 12.2.3 through 12.2.15, is affected by this vulnerability. Only these supported releases are listed in the vendor's advisory. The vulnerability does not affect other components or later releases beyond 12.2.15 as per the available information.

The CVSS 3.1 base score is 6.5, indicating a moderate to high impact due to the confidentiality loss. No EPSS score is available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA's KEV catalog at this time. Attackers would exploit it over the network by sending HTTP requests to the Payroll service. Since the required privilege level is low, only a standard network user with access to the Payroll interface can attempt the attack. The lack of additional authentication makes the risk of widespread compromise significant for organizations that expose the Payroll component to external or untrusted networks.