The vulnerability exists in the SQR component of PeopleSoft Enterprise PeopleTools. It allows an unauthenticated attacker with network access to communicate over HTTP and compromise the application. The outcome is unauthorized read or full access to all data exposed by PeopleSoft Enterprise PeopleTools. As a result, an attacker could obtain confidential data, potentially leading to a significant data breach. The weakness is an authentication bypass.

Oracle Corporation: PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. All deployments of these releases that expose the SQR component over HTTP are vulnerable. The product is the PeopleSoft Enterprise PeopleTools integrated with Oracle PeopleSoft applications.

The CVSS score of 7.5 indicates high severity with a major confidentiality impact and negligible integrity or availability impact. The EPSS score is currently unknown, but the lack of authentication requirement makes exploitation straightforward when network traffic to the application is reachable. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by sending crafted HTTP requests to the SQR endpoint without credentials, gaining unrestricted access to the application data. The risk is high for environments exposed to public or untrusted networks.