The vulnerability exists in the SQR component of PeopleSoft Enterprise PeopleTools. It allows an unauthenticated attacker with network access to communicate over HTTP and compromise the application. The outcome is unauthorized read or full access to all data exposed by PeopleSoft Enterprise PeopleTools. As a result, an attacker could obtain confidential data, potentially leading to a significant data breach. The weakness is an authentication bypass.

Oracle Corporation: PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. All deployments of these releases that expose the SQR component over HTTP are vulnerable. The product is the PeopleSoft Enterprise PeopleTools integrated with Oracle PeopleSoft applications.

The CVSS score of 7.5 indicates high severity with a major confidentiality impact and negligible integrity or availability impact. The EPSS score of < 1% indicates that exploitation probability is currently very low but not zero; nevertheless, the absence of authentication and readily exploitable HTTP endpoint make the vulnerability straightforward to use when traffic is reachable. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by sending crafted HTTP requests to the SQR endpoint without credentials, gaining unrestricted access to the application data. The risk is high for environments exposed to public or untrusted networks.