This vulnerability exists in the Test Framework component of Oracle PeopleSoft Enterprise PeopleTools. It allows an unauthenticated attacker who can reach the application over HTTP to read a limited set of data without needing credentials. The weakness corresponds to the deficiency identified by CWE-306, exposing information that should be protected and misconfiguring access control and authentication. It is considered easily exploitable. The CVSS 3.1 Base Score of 5.3 reflects a medium severity with a confidentiality impact only, as integrity and availability are not affected.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools, specifically the Test Framework component, is affected in versions 8.61 through 8.63. The vulnerability applies to all builds of these versions unless patched separately by Oracle.

The CVSS score indicates a moderate risk level. EPSS is available at a very low score of < 1%, indicating a minimal likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation to date. The likely attack vector is a remote, unauthenticated HTTP request made from an external network to the PeopleSoft Test Framework endpoints. Successful exploitation grants read access to sensitive data that should be restricted to authenticated users.