A low‑privileged attacker who can log on to the host where Oracle JDeveloper is running can exploit a vulnerability that grants read access to a subset of data accessible through the application. The flaw is a CWE‑200 Information Exposure weakness, allowing an attacker to read data that should be restricted by access controls. The flaw does not allow modification of data, escalation of privileges, or denial of service, but it can expose confidential information that was not intended for the attacker’s user scope.

Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These releases are used in Oracle Fusion Middleware deployments and are available in the reference list from Oracle.

The CVSS score of 3.3 reflects a low severity with a confidentiality impact only. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation activity. The indicated attack vector requires local access—an attacker must have at least low‑privilege credentials on the machine running JDeveloper, which is why the vector is listed as local access. Even with that requirement, the simplicity of the exploit and the potential to expose sensitive data make it a noticeable risk for environments where JDeveloper is exposed to multiple users or where configuration does not limit local access.