Vulnerability CVE-2017-3548
Published: 2017-04-24

Description:
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

See advisories in our WLB2 database:
Topic
Author
Date
High
Oracle PeopleSoft HCM 9.2 XXE Injection
Nadya Krivdyuk
21.04.2017

Type:

CWE-611

 (Information Exposure Through XML External Entity Reference)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
Partial
Affected software
Oracle -> Peoplesoft enterprise peopletools 

 References:
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
http://www.securityfocus.com/bid/97880
http://www.securitytracker.com/id/1038301
https://erpscan.io/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft/
https://www.exploit-db.com/exploits/41925/
Copyright 2024, cxsecurity.com

 

Back to Top