Oracle HRMS (Norway) is vulnerable to a network exposed HTTP‑based flaw that allows an attacker with low privileges to compromise the system. The exploitation path results in unauthorized access to critical data or full exposure of all Oracle HRMS (Norway) accessible data, thereby impacting confidentiality. The weakness is captured by the CVE’s vector, which indicates network access, low attack complexity, low privileges, and no user interaction are required. This vulnerability is graded with a CVSS 3.1 base score of 6.5, reflecting a moderate but noteworthy risk of data compromise.

Affected vendors and products: Oracle Corporation’s Oracle HRMS (Norway) component of Oracle E‑Business Suite. The versions explicitly listed as affected span from 12.2.3 up through 12.2.15. No other Oracle E‑Business Suite components or external systems were mentioned as being impacted within the provided data.

The vulnerability is easily exploitable if an attacker can reach the enterprise network via HTTP. The low privileges required mean that even users who are not administrators could trigger the flaw. With the CVSS score of 6.5 and an EPSS score of < 1%, the risk is considered moderate; however, because the impact involves full disclosure of business data, the vulnerability should be addressed promptly. Oracle does not list this CVE in the CISA KEV catalog, which currently does not elevate the perceived threat level but does not preclude exploitation by malicious actors. Official remediation from Oracle is not provided in the data set, so a vendor‑issued patch or update is the recommended fix path.