An unauthenticated attacker able to reach Oracle Time and Labor over HTTP can exploit a flaw that allows the attacker to perform unauthorized update, insert or delete operations and to read a subset of accessible data. The vulnerability resides in the Internal Operations component and results in confidentiality and integrity impacts, as defined by the CVSS score of 6.1.

The affected product is Oracle Time and Labor, part of Oracle E‑Business Suite, for the version range 12.2.3-12.2.15. Because the vulnerability has a scope change, successful exploitation could also affect other Oracle products that interact with Oracle Time and Labor.

The CVSS Base Score is 6.1, indicating moderate severity with limited confidentiality and integrity impact. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low likelihood of widespread attacks. The attack requires network access over HTTP, no authentication, but also demands human interaction from a person other than the attacker, which reduces the attacker's ability to automate exploitation. Nonetheless, the possibility of affecting additional products through scope change highlights the need for timely remediation.