The vulnerability resides in the Test Framework component of Oracle PeopleSoft Enterprise PeopleTools. An attacker who can log onto the infrastructure where PeopleSoft is running can exploit this weakness without any authentication. Successful exploitation grants unauthorized access to critical data or all data accessible by PeopleSoft, leading to confidentiality violations. The weakness aligns with improper access controls that allow unprivileged local users to retrieve sensitive information. The flaw also demonstrates an improper restriction of operations within the Test Framework, enabling unprivileged local users to perform privileged actions.

Oracle Corporation's PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected.

The CVSS 3.1 base score of 6.2 indicates a moderate severity with high confidentiality impact. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Since the attack vector is local, an attacker only needs to log onto the affected system, and no privileges are required. If an attacker gains that local logon, exploitation can lead to data exposure of highly sensitive information. The low EPSS suggests limited public knowledge of exploitation, but the moderate CVSS score still warrants concern due to the potential confidentiality impact.