The vulnerability allows a low‑privileged network attacker who can access Oracle Essbase over HTTP to read a subset of data stored in the application. The flaw is located in the Security component of Oracle Essbase version 21.8.3.0.0. Successful exploitation leads to a confidentiality impact, exposing sensitive data to an attacker with insufficient privileges.

Oracle Essbase 21.8.3.0.0 is the only affected version listed. The issue is confined to the Essbase product, but the possibility of impacting additional centered products cannot be excluded if they are connected to the same Essbase instance.

The CVSS 3.1 base score is 5.0, indicating moderate severity limited to confidentiality only. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is network‑based via HTTP, requiring only local network access and low privileges to perform an unauthorized data read. No specific conditions or elevated privileges are required, so the risk remains moderate but requires attention to prevent data exposure.