The PeopleSoft Enterprise PeopleTools product contains an unauthenticated HTTP vulnerability that enables an attacker to read a subset of accessible data and to cause a partial denial of service. The weakness allows exploitation without authentication and results in confidentiality and availability impacts, as reflected in the CVSS 3.1 base score of 6.5. The vulnerability exists in the Business Interlink component of the product and is classified as a moderate severity flaw.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools version 8.61 through 8.63 are affected. The vulnerability is specific to the Business Interlink component of this product line.

The CVSS score of 6.5 indicates a moderate risk while the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw from any network location with HTTP access to the exposed interface; no additional privileges are required. Because no user interface is needed, the attack vector is likely a direct HTTP request to the Business Interlink endpoint.