Health Sciences DMW CVE-2025-62288

Exploitation requires an already-authenticated HIGH-privilege account on Oracle Health Sciences Data Management Workbench (CVSS PR:H) with HTTP network access to the application, specifically its Logger component. There is no user-interaction requirement (UI:N) and complexity is low (AC:L), so a privileged attacker can trigger it reliably. The key LIMITING factors are the need for pre-existing elevated/administrative privileges (making this primarily an insider or post-compromise threat rather than an unauthenticated remote attack) and the restriction to affected versions 3.4.0.1.3 and 3.4.1.0.10; impact is confined to confidentiality (data disclosure) with no integrity or availability effect.

This is a moderate-severity, low-priority issue despite being network-exploitable. The CVSS 3.1 base score of 4.9 reflects a confidentiality-only impact (C:H/I:N/A:N) that is gated by a high-privilege requirement (PR:H) - the attacker must already hold elevated/administrative access to the Oracle Health Sciences Data Management Workbench before the flaw (CWE-267, privilege management) can be abused. AC:L and UI:N mean that once that privilege is held, exploitation is reliable and requires no victim interaction, but the PR:H precondition sharply limits the realistic attacker population to insiders or those who have already compromised a privileged account. The EPSS score of 0.30% (21st percentile) is low and consistent with the absence of any KEV listing or public POC, indicating no observed or expected mass exploitation. There is a signal conflict worth flagging: the input Tags include 'Authentication Bypass,' which contradicts both the CVSS vector (PR:H, meaning authentication is required, not bypassed) and the CWE-267 classification (privilege-escalation/mismanagement, not auth bypass) - treat the 'Authentication Bypass' label as unreliable and verify against Oracle's advisory. Overall: a real but insider/post-compromise confidentiality risk, not an urgent internet-facing emergency.

An attacker who already holds a high-privilege account on Oracle Health Sciences Data Management Workbench sends crafted HTTP requests to the Logger component, abusing an unsafe privileged action to read clinical trial or health data they should not be able to access. No user interaction is required and the attack is low-complexity once privileged access exists. No public exploit code has been identified at time of analysis.