This vulnerability affects the SQR component of Oracle PeopleSoft Enterprise PeopleTools and allows a low privileged attacker who can reach the system via HTTP to compromise the application. Successful exploitation leads to unauthorized access to critical data or complete access to all data exposed by PeopleSoft Enterprise PeopleTools. The CVSS 3.1 Base Score of 6.5 indicates a medium severity with significant confidentiality impact.

Oracle Corporation PeopleSoft Enterprise PeopleTools versions 8.61, 8.62, and 8.63 are affected.

It has a CVSS score of 6.5, placing it in the medium severity range. The EPSS score of < 1 % indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, so no known active exploitation is reported. The attack vector is likely via an HTTP request to the SQR component, requiring only low privileges; if an attacker can reach the target network, they can potentially read confidential data without additional privileges.