The vulnerability resides in the Human Resources component of JD Edwards EnterpriseOne Human Resources Management version 9.2. An unauthenticated attacker with network access via the JDENET interface can exploit the flaw to perform unauthorized insert, update, or delete operations on database records, and to read a subset of restricted data. This results in loss of integrity and confidentiality for sensitive HR data, although the impacts are classified as low in the CVSS vector. The weakness corresponds to improper access control.

The affected system is Oracle Corporation’s JD Edwards EnterpriseOne Human Resources Management product, specifically version 9.2. No other versions or components are listed as impacted.

The CVSS Base Score of 4.8 indicates moderate risk, with low confidentiality and integrity impact but no availability impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited in the wild. Exploitation requires unauthenticated network connectivity to the JDENET service, which is likely confined to internal or segmented networks. Attackers would need to discover the exposed interface and craft a request that bypasses standard authentication controls.