PT-2025-4267 · Oracle · Peoplesoft Enterprise Peopletools

Published 2025-01-21 · Updated 2025-01-22 · CVE-2025-21545

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PeopleTools versions 8.60 through 8.61

Description The issue allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, resulting in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. This is due to a resource exhaustion vulnerability in the OpenSearch component.

Recommendations For versions 8.60 and 8.61, consider restricting access to the OpenSearch component to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2025-01246

CVE-2025-21545

Affected Products

Peoplesoft Enterprise Peopletools

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-21545 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21545 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2025.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01246 · Security Note
• https://twitter.com/VulmonFeeds/status/1881900445502758994 · Twitter Post
• https://twitter.com/CVEnew/status/1881821738243428363 · Twitter Post