CVE-2021-2063: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal) affects versions 8.56, 8.57 and 8.58. This easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise the system. The vulnerability was disclosed on January 20, 2021 (Oracle Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 8.4 (High) with the vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The scoring indicates local access vector, low attack complexity, no privileges required, no user interaction needed, unchanged scope, and high impacts on confidentiality, integrity, and availability (NVD).

Successful exploitation of this vulnerability can result in complete takeover of PeopleSoft Enterprise PeopleTools, potentially compromising the confidentiality, integrity, and availability of the system (NVD).

The vulnerability is considered easily exploitable and requires an unauthenticated attacker to have logon access to the infrastructure where PeopleSoft Enterprise PeopleTools executes (Oracle Advisory).

Oracle has released patches for the affected versions (8.56, 8.57, and 8.58) as part of the January 2021 Critical Patch Update. It is strongly recommended to apply these security patches as soon as possible (Oracle Advisory).

The vulnerability was reported by multiple security researchers from ING Tech Poland, including Lukasz Plonka, Maciej Grabiec, and Pawel Gocyla (Oracle Advisory).