Technical impact
The vulnerability allows an attacker with network access over HTTP to acquire high‑privileged access to Oracle HR Intelligence, compromising confidential data, integrity, and availability. Successful exploitation effectively enables an attacker to take full control of the HR Intelligence application, undermining all data and operations it exposes. The weakness arises from insufficient privilege and access control in the Internal Operations component, permitting unauthorized escalation through exposed HTTP endpoints.
Affected Systems
Oracle HR Intelligence, part of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, is affected. The flaw exists in the Internal Operations module and impacts any installation that uses those version ranges.
Risk and Exploitability
The CVSS score of 7.2 classifies the flaw as High, with a network attack vector, low attack complexity, high privilege required, and no user interaction. The EPSS score is below 1 %, indicating a very low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. An attacker must issue a malicious HTTP request to a vulnerable internal‑operations endpoint, allowing them to assume privileged access and compromise the entire HR Intelligence instance.
