A vulnerability in the Oracle Communications Billing and Revenue Management (BRM) Server permits a low‑privileged user who has logged onto the underlying system to access sensitive data within BRM. The flaw allows the attacker to read critical information or potentially retrieve all data accessible through the application, representing a confidentiality breach. The vulnerability’s description does not explicitly identify a specific weakness type; it only describes the resulting unauthorized access.

The affected products are Oracle Communications Billing and Revenue Management 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. These versions are distributed under the Oracle Communications suite and are identified by their corresponding CPE entries.

The CVSS 3.1 base score of 5.5 indicates a medium severity impact, primarily due to confidentiality loss. Exploit requires local access, so the attack vector is limited to users already logged onto the infrastructure where BRM is running. The attacker only needs a low‑privileged account. EPSS is not available, so the current exploit probability is uncertain, but the vulnerability is described as easily exploitable and listed in an Oracle security advisory, raising concerns. The vulnerability is not catalogued in CISA's KEV list.