A vulnerability in the Work Order Management component of Oracle PeopleSoft Enterprise FIN Maintenance Management allows a low‑privileged attacker who can reach the application over HTTP to compromise the system. The flaw enables the attacker to read all data exposed by the application, resulting in the disclosure of sensitive financial information. The CVE description does not explicitly state the weakness type; it is inferred that improper access control or authentication is involved, but this inference is not guaranteed.

Oracle’s PeopleSoft Enterprise FIN Maintenance Management version 9.2, specifically the Work Order Management component, is affected.

The CVSS 3.1 base score of 6.5 reflects a medium‑severity risk with a low privilege requirement and a network attack vector. EPSS data is unavailable, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Because an attacker only needs network access to the HTTP interface and does not require high privileges, the exploit path is relatively simple, making this a viable threat for environments where the PeopleSoft instance is exposed to untrusted networks.