The vulnerability exists in the Web Runtime SEC component of JD Edwards EnterpriseOne Tools. It is an Information Disclosure weakness (CWE-200). An unauthenticated attacker with network access through HTTP can exploit the flaw if they manage to induce a user other than themselves to interact with the system. The consequence is read access to a subset of data normally protected, resulting in a confidentiality impact without affecting integrity or availability.

Affected vendors/products include Oracle Corporation's JD Edwards EnterpriseOne Tools. All supported versions from 9.2.0.0 up to 9.2.26.5 inclusive are susceptible. No specific patch or version upgrade was identified in the data.

The CVSS 3.1 base score is 4.3, indicating a moderate severity mainly for confidentiality. Because the EPSS score is unavailable and the vulnerability is not listed in KEV, the likelihood of exploitation appears low. The attack vector is network‑based via HTTP and requires human interaction, presenting a realistic risk for environments where the Tools are exposed. The flaw does not allow remote code execution or denial of service but can still enable attackers to gather sensitive information.