CVE-2021-2043: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). The vulnerability affects versions 8.56, 8.57 and 8.58. This vulnerability was discovered and reported in December 2020, as indicated by the record creation date of December 9, 2020 (MITRE).

The vulnerability is easily exploitable by an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. The vulnerability has a CVSS 3.1 Base Score of 6.1 (Confidentiality and Integrity impacts) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (MITRE).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. The vulnerability requires human interaction from a person other than the attacker, and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (MITRE).

The vulnerability is considered easily exploitable by an unauthenticated attacker with network access via HTTP. The attack requires human interaction from a person other than the attacker to be successful (MITRE).

Oracle released patches for this vulnerability as part of their January 2021 Critical Patch Update. Users are advised to update their PeopleSoft Enterprise PeopleTools to the latest patched versions (Oracle CPU).