PT-2023-3703 · Oracle · Peoplesoft Enterprise Peopletools

Published

2023-07-18

·

Updated

2025-04-07

·

CVE-2023-22047

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PeopleTools versions 8.59 through 8.60
Description The issue is related to insufficient input validation in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft, specifically in the Portal component. This allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, resulting in unauthorized access to critical data or complete access to all accessible data.
Recommendations For versions 8.59 and 8.60, update to a version that includes the fix for this issue to prevent unauthorized access to critical data. As a temporary workaround, consider restricting access to the Portal component until a patch is available. Avoid using the vulnerable component until the issue is resolved.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306CWE-20

Related Identifiers

BDU:2023-03991
CVE-2023-22047

Affected Products

Peoplesoft Enterprise Peopletools