The portal component of Oracle PeopleSoft Enterprise PeopleTools contains an unauthenticated vulnerability that can be triggered through HTTP requests. Successful exploitation requires that a human other than the attacker performs interaction, such as clicking a link or submitting a form. When leveraged, the flaw permits an attacker to update, insert, or delete data and to read a subset of data that should be protected, thereby affecting confidentiality and integrity. The CVSS 3.1 base score of 6.1 indicates moderate severity, with impacts limited to confidentiality and integrity and no availability loss.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools, specifically the Portal component in versions 8.61 through 8.62. The vulnerability exists in the PeopleSoft Enterprise PeopleTools product as shipped in these releases.

The CVSS score of 6.1 classifies the flaw as moderate, while the absence of an EPSS score and the KEV designation suggest no widely known exploitation at this time. Attackers must have network access and can exploit the flaw via normal HTTP traffic to the portal; however, success still requires UI interaction by a user who is not the attacker, which raises the barrier to full exploitation. Overall, the risk is moderate but remains actionable because the flaw affects critical business data and could impact additional products if the scope changes.