The vulnerability resides in the Employee Snapshot component of PeopleSoft Enterprise HCM Human Resources 9.2 and permits a low-privileged attacker with network access over HTTP to perform unauthorized updates, inserts, or deletions of data, as well as read restricted data. The potential impact on confidentiality and integrity is classified as low by the CVSS vector, indicating that attackers can alter or view some data but cannot bring the application offline. The weakness aligns with improper access control, where access permissions are not correctly enforced.

Oracle Corporation’s PeopleSoft Enterprise HCM Human Resources version 9.2 is affected. The issue impacts the Employee Snapshot component and could potentially cascade to other PeopleSoft products due to a scope change.

The CVSS Base Score of 5.4 indicates moderate risk. The attack vector is network-based; the attacker requires a low-privileged account, human interaction from a non-attacker user, and the vulnerability does not affect availability. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, so while exploitation is possible, the likelihood is uncertain. The moderate severity and limitation to low-privileged users suggest that patching remains the primary defense.