The vulnerability resides in the Work Order Management component of Oracle PeopleSoft Enterprise FIN Maintenance Management. It permits a low‑privileged attacker with network connectivity over HTTP to compromise the system and gain unauthorized access to all business data. The attack does not affect integrity or availability, but it severely impacts confidentiality by allowing full data traversal.

Affected is Oracle Corporation’s PeopleSoft Enterprise FIN Maintenance Management product, version 9.2. No other versions or variants are noted.

The CVSS 3.1 base score of 6.5 indicates a medium severity. Although the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the vector AV:N/AC:L/PR:L indicates that a local network attacker can easily reach the vulnerable HTTP interface. No public exploit information is provided, but the low privilege requirement suggests that this flaw could be abused by insiders or compromised credentials.