In Oracle HRMS (US) within Oracle E‑Business Suite, a flaw in the Internal Operations component allows a low‑privileged attacker who can reach the system over HTTP to bypass authorization controls and read sensitive human‑resources data. Successful exploitation can provide unauthorized access to critical HR records or all data available through HRMS, without affecting data integrity or availability. The vulnerability is assessed with a CVSS 3.1 Base Score of 6.5, indicating moderate severity that primarily impacts confidentiality.

Oracle HRMS (US) for Oracle E‑Business Suite. Versions 12.2.3 through 12.2.15 are affected.

An attacker requires only HTTP network access and low digital privileges to exploit the flaw. The attack vector is network‑based, with low complexity and low attack privileges, resulting in a high confidentiality impact. The EPSS score of less than 1% shows a low, but non‑negligible exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and it is currently addressed by the CVSS score of 6.5.