A flaw in the User Interface component of Oracle Financial Services Analytical Applications Infrastructure allows a low‑privileged attacker with network access over HTTP to compromise the application. The vulnerability requires a victim to interact with the compromised UI, typically through social engineering, and can enable unauthorized access to critical data or complete exfiltration of all data exposed by the application. The weakness is an improper access control that primarily impacts confidentiality while leaving integrity and availability unaffected.

Oracle Corporation’s Financial Services Analytical Applications Infrastructure, specifically versions 8.0.7.9, 8.0.8.7, and 8.1.2.5, as identified by the User Interface component of these products.

The CVSS 3.1 base score of 4.8 indicates moderate severity, driven by confidentiality impact. EPSS is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote over HTTP, requiring low attacker privileges and a human victim to interact with the compromised UI. Although exploitation is not trivial, the need for social engineering increases practical risk for organizations that expose this component to external or untrusted networks.