An Oracle Business Intelligence Enterprise Edition component possesses an easily exploitable weakness that allows a low‑privileged attacker who can reach the system over HTTP to carry out unauthorized updates, inserts, or deletions of data, as well as read restricted data. The vulnerability can violate data confidentiality and integrity without affecting availability, and the description indicates that exploitation may also impact other Oracle products due to a scope change.

The affected product is Oracle Business Intelligence Enterprise Edition, version 12.2.1.4.0, which is part of Oracle Analytics. Only this version is listed as vulnerable; no other versions or components are mentioned.

The vulnerability has a CVSS 3.1 base score of 6.4, representing a moderate threat. An EPSS score of < 1% indicates that exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog, so no known public exploits have been reported. The attack vector is over the network via HTTP, requiring only low privilege and no user interaction, implying that an adversary with network access could readily exploit it to alter or read data.