An unauthenticated attacker with network access via HTTP can update, insert, or delete data in Oracle JD Edwards EnterpriseOne Human Resources Management. The vulnerability results in integrity impacts only and does not affect confidentiality or availability. The attack can occur without prior authentication or privilege escalation.

The affected product is Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. No other versions or products are listed as impacted.

The CVSS 3.1 base score of 3.7 indicates a low severity threat with limited integrity impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low exploitation probability. The attack vector is likely network-based over HTTP, requiring no authentication but necessitating connectivity to the affected service. Given the moderate difficulty and lack of publicly known exploits, the overall risk is considered low, but any unauthorized data modification is disruptive to business processes.