The vulnerability resides in the Portal component of Oracle PeopleSoft Enterprise PeopleTools, affecting releases 8.61 through 8.63. A low‑privileged attacker who can reach the system over HTTP can compromise the application if a user other than the attacker interacts with a supplied interface. Once the attack succeeds, the attacker can insert, update, or delete data that is normally protected and can read a subset of sensitive information, thereby violating confidentiality and integrity.

Systems running Oracle PeopleSoft Enterprise PeopleTools Portal version 8.61, 8.62 or 8.63 that expose the Portal over network boundaries are at risk. The weakness can also elevate its impact beyond PeopleSoft itself, potentially affecting other Oracle products accessed through the same environment due to scope change in the CVSS vector.

The CVSS base score of 5.4 signifies a moderate severity, with complementary confidentiality and integrity impacts. Exploitation requires network access, low privileges, and user interaction, which reduces the likelihood of automated attacks. The EPSS score is <1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting limited observed exploitation. Nevertheless, the potential for unauthorized data manipulation and disclosure warrants timely mitigation.