The vulnerability exists in the Mobile Applications component of Oracle HRMS (US) and allows an attacker who controls a low‑privileged network connection over HTTP to read, insert, update, or delete data that should be protected. The weakness stems from information exposure (CWE‑200). Exploitation requires a user other than the attacker to provide interaction, but the initial access barrier is low, making the attack relatively straightforward for adversaries who can influence or coerce such a user.

Oracle Corporation’s Oracle HRMS (US) product, specifically the Mobile Applications component, is affected in versions 12.2.3 through 12.2.15. The description notes that the issue may also impact other Oracle E‑Business Suite products because of a scope change.

The CVSS 3.1 score of 5.4 indicates a moderate severity with impacts on confidentiality and integrity but no impact on availability. The EPSS score of < 1% indicates a very low exploitation probability, reflecting the difficulty of real‑world attacks despite the low initial access barrier. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based HTTP access, requiring the attacker to obtain or manipulate a low‑privileged account or rely on a human user to provide higher privileges. If successful, the attacker can modify or read sensitive HR data, potentially leading to financial loss, compliance violations, or reputational damage.