PT-2025-4282 · Oracle · Peoplesoft Enterprise Scm Purchasing

Published 2025-01-21 · Updated 2025-01-21 · CVE-2025-21561

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise SCM Purchasing version 9.2

Description The issue is related to improper authorization in the Purchasing component of PeopleSoft Enterprise SCM Purchasing, allowing an attacker with reduced privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to update, insert, or delete some accessible data, as well as unauthorized read access to a subset of accessible data.

Recommendations For version 9.2, consider applying security patches or updates to address the improper authorization issue in the Purchasing component. As a temporary workaround, restrict access to the Purchasing component to minimize the risk of exploitation. Additionally, limit HTTP requests to the affected system until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-01349

CVE-2025-21561

Affected Products

Peoplesoft Enterprise Scm Purchasing

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-21561 · Security Note
• https://oracle.com/security-alerts/cpujan2025.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01349 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21561 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1881846684835008530 · Twitter Post
• https://t.me/cvedetector/16026 · Telegram Post
• https://twitter.com/CVEnew/status/1881821722292502676 · Twitter Post
• https://vuldb.com/fr/?id.292789 · Note