This vulnerability allows an unauthenticated attacker who has logged onto the infrastructure where Oracle PeopleSoft Enterprise PeopleTools runs to compromise the application. The flaw is found in the Porting component and requires human interaction from a user other than the attacker. Upon successful exploitation, the attacker can update, insert, or delete data that the application normally protects, can read a subset of protected data, and can cause a partial denial of service of the application. The weakness is rooted in improper access control and information exposure vulnerabilities.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools product is affected in versions 8.61 through 8.63. These versions are marked as supported and can be installed on enterprise infrastructure that may still be in use.

The flaw scores a CVSS 3.1 Base Score of 4.5, indicating moderate severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation in the current environment, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local (AV:L) with a high attack complexity (AC:H), and it requires the attacker to have some level of legitimate infrastructure access. Because the exploit needs a different human to interact with the system, the overall risk to an organization is limited but not negligible. Incidentally, users who have not applied critical patches for the affected releases remain susceptible to unauthorized data access and limited denial of service.