The flaw resides in the ADF Faces component of Oracle JDeveloper and permits a low‑privileged attacker who can log on to the infrastructure where JDeveloper runs to read any data that the JDeveloper instance can access. Successful exploitation is possible without network connections or elevated privileges, and the only requirement is that the attacker can exercise a local session. The CVSS v3.1 base score of 5.5 reflects a confidentiality impact caused by unauthorized information disclosure.

Oracle JDeveloper releases 12.2.1.4.0 and 14.1.2.0.0 are impacted. These versions are part of the Oracle Fusion Middleware product family and are referenced in the Oracle security advisory linked in the input.

The moderate CVSS score indicates that the vulnerability is neither trivial nor critical, but the fact that it can be exploited locally and requires only low privileges makes it a practical threat in environments where JDeveloper runs with any user account that has file‑system access. The EPSS value is reported as < 1% (approximately 0.00145), implying a low probability of being targeted in the wild. The vulnerability is not included in CISA’s KEV list. Attackers can likely obtain their goals by simply logging onto the host and executing the application without advanced techniques.