This vulnerability allows an attacker with only low privileges and network access through HTTP to compromise the Oracle HRMS (Republic of Korea) system. By exploiting insufficient access controls, the attacker can read confidential payroll data or even gain full access to all data available in the HRMS. The weakness is a confidentiality impact as reflected in the CVSS vector.

Affected products are Oracle HRMS (Republic of Korea) used as the Korean Payroll component of Oracle E-Business Suite. The vulnerability impacts supported versions 12.2.3 through 12.2.15.

The CVSS base score of 6.5 indicates a moderate severity with a confidentiality impact only. The EPSS score of 0.00355 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. However, the low attack complexity, network accessibility via HTTP, and low privilege requirement make the attack path straightforward for anyone with network access to the HRMS host. An attacker can leverage this to exfiltrate sensitive payroll information or to compromise the entire HRMS data set. Based on the description, it is inferred that the likely attack vector involves network-based HTTP access to the HRMS server, as the description explicitly references low privileged network access via HTTP.