A flaw in the PeopleSoft Enterprise PeopleTools Portal component permits an unauthenticated attacker with network access via HTTP to influence data operations within the application. The vulnerability requires that a user other than the attacker interacts with the system, typically by clicking a link or performing an action that the attacker originated. Once activated, the attacker gains the ability to insert, update, or delete records and unauthorized read access to a subset of the system’s data, thereby impacting data integrity and confidentiality.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools versions 8.60, 8.61 and 8.62 are affected. The issue resides in the Portal component of these product releases.

The CVSS v3.1 base score of 6.1 indicates a medium severity vulnerability that compromises confidentiality and integrity. The EPSS score is less than 1%, suggesting current exploitation activity is rare, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is a simple HTTP request that requires no authentication and only a single human interaction, making the condition only moderately hard to meet. While the risk is not high, the potential for data loss or unauthorized disclosure warrants prompt remediation.