Vulnerability in Oracle US Federal Human Resources allows a low‑privileged attacker with network access over HTTP to compromise the application. The flaw permits unauthorized access to critical data or full access to all data exposed by the system, resulting in a confidentiality loss. The weakness is an instance of missing proper access control, leading to direct data exposure.

Oracle US Federal Human Resources, a component of Oracle E‑Business Suite, supports versions 12.2.3 through 12.2.15. Users of these versions should verify whether they are running within this affected range.

The vulnerability has a CVSS 3.1 base score of 6.5, indicating moderate severity. EPSS is not available and it is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation in the wild. The likely attack vector is network‑based over HTTP, with low attack complexity and a low privilege requirement, making it relatively easy for an attacker with network access to leverage the flaw. While the risk remains moderate, it warrants timely remediation.