Vulnerability in Oracle HRMS (US) within the Oracle E‑Business Suite allows a low‑privileged attacker with network access via HTTP to compromise the application, potentially exposing critical or all data stored in Oracle HRMS (US). The flaw is a case of information disclosure (CWE‑200). The impact is a loss of confidentiality while integrity and availability remain unaffected.

Oracle Corporation’s Oracle HRMS (US) component of Oracle E‑Business Suite, specifically the Internal Operations module, is affected. Affected versions are 12.2.3 through 12.2.15. Users running these versions should verify their installation against the listed range.

With a CVSS 3.1 Base Score of 6.5, the vulnerability presents moderate overall severity, with a high confidentiality impact (C:H). The likely attack path involves a low‑privileged attacker connected to the network and sending an HTTP request to the HRMS. No user interaction is required for exploitation. The EPSS score of < 1% indicates a very low probability of exploitation, and the absence of a KEV listing suggests no known widespread exploitation yet, but the ease of exploitation and confidentiality impact warrant proactive mitigation.