Vulnerability exists in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63. The flaw requires a high privileged attacker with network connectivity over HTTP and is difficult to exploit, but when successful it can grant the attacker unauthorized access to critical data or complete access to all data exposed by PeopleSoft Enterprise PeopleTools.

Oracle PeopleSoft Enterprise PeopleTools, versions 8.61, 8.62 and 8.63.

The CVSS 3.1 score of 5.8 indicates a moderate severity primarily affecting confidentiality. The EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV, so there is no evidence of widespread exploitation yet. However, the vector indicating network access over HTTP and a scope change suggests that if exploited, the attacker could affect additional Oracle products, enabling unauthorized data theft. The vulnerability is considered difficult to exploit, but attackers with sufficient access could achieve these goals.