The vulnerability resides in the Total Compensation Statement component of Oracle Compensation Workbench, allowing an attacker with low privileges and network access over HTTP to modify, insert, or delete data and to read restricted subsets of data. This results in confidentiality and integrity impacts for the compromised information. The flaw is an authorization weakness that permits unauthorized data access to users who should not possess such permissions, and this classification as an authorization weakness is inferred from the description rather than explicitly stated.

Oracle Compensation Workbench 12.2.3 through 12.2.15 as part of Oracle E‑Business Suite has been identified as vulnerable. No other products or versions were listed as affected.

The CVSS 3.1 base score of 5.4 indicates a moderate severity, with the attack vector limited to network access via HTTP. The vulnerability requires a low privileged attacker and depends on the cooperation of a user other than the attacker. Although the EPSS score is not available and the vulnerability is not listed in CISA KEV, the fact that it permits unauthorized data modification and disclosure warrants timely remediation. The scope is considered changed, meaning successful exploitation could have effects beyond the Oracle Compensation Workbench itself.