PT-2017-15982 · Oracle · Peoplesoft Enterprise Peopletools

Nadya Krivdyuk · Published 2017-04-24 · Updated 2026-06-13 · CVE-2017-3548

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PeopleTools versions 8.54 and 8.55

Description An issue exists in the Integration Broker subcomponent of PeopleSoft Enterprise PeopleTools. An unauthenticated attacker with network access via HTTP can compromise the system. Successful exploitation may lead to unauthorized read access to a subset of accessible data and the ability to cause a partial denial of service (DOS), which is a condition where the system becomes partially unavailable to its intended users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-3548

Affected Products

Peoplesoft Enterprise Peopletools

References · 10

• 🔥 https://exploit-db.com/exploits/41925 · Exploit
• 🔥 https://exploit-db.com/exploits/43114 · Exploit
• https://osv.dev/vulnerability/CVE-2017-3548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3548 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html · Vendor Advisory
• https://twitter.com/rst_cloud/status/2065795763410436146 · Twitter Post
• http://securityfocus.com/bid/97880 · Note
• https://t.me/aptreports/29680 · Telegram Post
• https://erpscan.io/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft · Note
• http://securitytracker.com/id/1038301 · Note