The vulnerability exists in the Porting component of Oracle PeopleSoft Enterprise PeopleTools. It allows an attacker who has logged onto the underlying infrastructure with low privileges to cause repeated crashes of the application, resulting in a denial of service. In addition, the attacker can update, insert, delete, or read data that is normally protected by the application, thereby violating the confidentiality, integrity, and availability of the affected data. The weakness is a result of insufficient access control checks, allowing unauthorized operations through the affected component.

Oracle PeopleSoft Enterprise PeopleTools versions 8.61, 8.62, and 8.63 are affected. The vulnerability is specific to the PeopleSoft Enterprise PeopleTools product and is not present in preceding or subsequent releases outside this range.

The CVSS v3.1 base score of 6.6 indicates a moderate severity vulnerability. The attack vector is local (AV:L) with low access complexity and local privileges required, meaning an attacker needs to be logged in to the system where the application runs. User interaction is not required. The vulnerability is not listed in the CISA KEV catalog, and the EPSS score is less than 1%, indicating a very low exploitation probability, though the exact likelihood remains uncertain. However, the potential impact of a successful compromise, including denial of service and unauthorized data tampering, is significant for organizations running the affected versions.