The vulnerability resides in Oracle's Middleware Common Libraries and Tools, specifically within the Remote Diagnostic Agent component. It permits an unauthenticated attacker with network access via HTTP to read a subset of data that the agent exposes. The flaw compromises confidentiality, allowing unauthorized access to information that should otherwise remain restricted.

Oracle Corporation’s Oracle Middleware Common Libraries and Tools, versions 12.2.1.4.0 and 14.1.1.0.0, part of Oracle Fusion Middleware. These versions are the ones identified as affected by the advisory.

The CVSS 3.1 score of 3.7 indicates a low severity vulnerability with high attack complexity, no privileges and no user interaction required. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is HTTP network access; the attacker exploits a missing authentication or authorization check to gain read access to the agent’s data.