PT-2019-1856 · Oracle · Peoplesoft Enterprise

Published 2019-04-16 · Updated 2020-08-24 · CVE-2019-2700

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise ELM version 9.2

Description The issue is related to inadequate access control in the Enterprise Learning Mgmt component of PeopleSoft Enterprise ELM. This can be exploited by a remote attacker to gain unauthorized access to protected information using the HTTP protocol. Successful attacks may result in unauthorized update, insert, or delete access to some accessible data.

Recommendations For version 9.2, apply the necessary security patches to fix the inadequate access control issue. As a temporary workaround, consider restricting access to the Enterprise Learning Mgmt component until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2019-01508

CVE-2019-2700

Affected Products

Peoplesoft Enterprise

References · 5

• http://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01508 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-2700 · Security Note
• https://osv.dev/vulnerability/CVE-2019-2700 · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Note