The vulnerability in Oracle HRMS (US) permits a low‑privileged attacker with network access to HTTP to compromise the system and gain unauthorized access to critical data. The flaw allows confidentiality compromise while leaving integrity and availability untouched. The described attack is low in privilege scope but could provide complete access to all data reachable by the HRMS application.

Affected products are Oracle Corporation's Oracle HRMS (US) component of Oracle E‑Business Suite. The vulnerability affects versions 12.2.3 through 12.2.15 inclusive. No other vendors or product variants are reported as impacted.

This flaw carries a CVSS 3.1 base score of 6.5, indicating a moderate severity with a high confidentiality impact. The EPSS score is currently unreported, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited publicly known exploitation. An attacker can exploit it remotely over HTTP with only low privileges; the vulnerability is considered easily exploitable as mentioned in the description. The likely attack vector is network‑based HTTP traffic, as explicitly noted, with no special conditions stated.