The PeopleSoft Enterprise CC Common Application Objects component, specifically the BAM Framework, contains a vulnerability that allows an attacker who is not authenticated to send HTTP requests and alter data in the system. Successful exploitation can result in unauthorized updates, inserts or deletions of information, which directly affects the integrity of the data stored by the application. The flaw is reported with a CVSS base score of 3.7, indicating a low severity impact but still relevant because integrity violations can compromise business processes.

Oracle Corporation’s PeopleSoft Enterprise CC Common Application Objects version 9.2 is affected. The vulnerability is tied to the PeopleSoft deployment of the BAM Framework and impacts only that specific product release.

The vulnerability is exploitable remotely over HTTP by unauthenticated users, requiring only network access. The CVSS score of 3.7 reflects a low severity rating, and the EPSS score is not available. The issue is not listed in the CISA KEV catalog. Although the exploitation path is straightforward – send a crafted HTTP request to the vulnerable component – the low severity indicates that only individuals with a specific need to modify the application data would prioritize exploitation. This risk is further limited by the absence of a publicly known exploit and the requirement for a direct connection to the target service.