The vulnerability resides in the Meta Data component of Oracle PeopleSoft Enterprise PeopleTools and allows an attacker who possesses high privileged credentials and can reach the HTTP interface to read sensitive data or obtain full access to all data exposed by PeopleSoft. This flaw also enables the attacker to cause the application to hang or repeatedly crash, resulting in a complete denial of service. The weakness is an instance of improper information disclosure, which is captured by CWE‑200. The CVSS 3.1 base score of 6.5 indicates a moderate impact score with high confidentiality and availability damages.

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. Only systems running these specific releases are vulnerable to the data exposure and denial of service described. The vulnerability is limited to the Meta Data component and does not extend to other PeopleSoft modules.

The attack vector is straightforward: a remote attacker with high privileged credentials and network access to the PeopleSoft HTTP interface can exploit the flaw. Once accessed, the attacker can expose confidential data or disrupt the application. The CVSS score of 6.5 reflects moderate severity; the EPSS score of < 1% indicates that exploitation is currently unlikely under normal conditions; the issue is not listed in the CISA KEV catalog. However, the combination of required credentials and exposed HTTP access means that organizations with internal or network access to PeopleSoft are at higher risk.