The vulnerability in Oracle APEX Sample Applications' Brookstrut Sample App allows an attacker with low privileges and network access to HTTP to perform unauthorized update, insert, delete and read operations on accessible data. The flaw can be exploited only when an additional human actor interacts with the application, implying a social engineering component. Successful exploitation leads to confidentiality and integrity impacts to a subset of data.

Oracle Corporation's Oracle APEX Sample Applications, specifically the Brookstrut Sample App, in versions 23.2.0, 23.2.1, 24.1.0, 24.2.0 and 24.2.1.

CVSS 3.1 base score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not currently listed in the KEV catalog. The attack vector is likely HTTP network access, with low privileged user and human interaction from a non-attacker, indicating that social engineering or phishing may be needed. Because the flaw can change the integrity scope, unpatched systems could be exposed to unauthorized data modification if exploited, but the overall risk remains moderate.