CVE-2024-21070: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework) affects versions 8.59, 8.60, and 8.61. This vulnerability allows unauthenticated attackers with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools (Oracle CPU).

The vulnerability has been assigned a CVSS 3.1 Base Score of 5.4 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. The attack vector is network-based, requires low attack complexity, needs no privileges, but does require user interaction. The scope is unchanged, with low impacts on both confidentiality and integrity, and no impact on availability (Oracle CPU).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data (Oracle CPU).

The vulnerability is easily exploitable by an unauthenticated attacker with network access via HTTP. However, successful attacks require human interaction from a person other than the attacker (Oracle CPU).

Oracle has released security patches to address this vulnerability as part of the April 2024 Critical Patch Update. Organizations using affected versions of PeopleSoft Enterprise PeopleTools (8.59, 8.60, and 8.61) should apply the security patches as soon as possible (Oracle CPU).