CVE-2024-21154

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21154
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.oracle.com/security-alerts/cpujul2024.html Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2024.html Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*
History

17 Jun 2025, 20:01

Type Values Removed Values Added
First Time Oracle
Oracle peoplesoft Enterprise Hcm Human Resources
References () https://www.oracle.com/security-alerts/cpujul2024.html - () https://www.oracle.com/security-alerts/cpujul2024.html - Vendor Advisory
CPE cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*

21 Nov 2024, 08:53

Type Values Removed Values Added
References () https://www.oracle.com/security-alerts/cpujul2024.html - () https://www.oracle.com/security-alerts/cpujul2024.html -

05 Nov 2024, 16:35

Type Values Removed Values Added
CWE CWE-79
Summary
  • (es) Vulnerabilidad en el producto PeopleSoft Enterprise HCM Human Resources de Oracle PeopleSoft (componente: Recursos Humanos). La versión compatible que se ve afectada es la 9.2. Una vulnerabilidad fácilmente explotable permite a un atacante con pocos privilegios y acceso a la red a través de HTTP comprometer PeopleSoft Enterprise HCM Human Resources. Los ataques exitosos a esta vulnerabilidad pueden resultar en acceso de lectura no autorizado a un subconjunto de datos accesibles de Recursos Humanos de PeopleSoft Enterprise HCM. CVSS 3.1 Puntaje base 4.3 (Impactos en la confidencialidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

16 Jul 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 23:15

Updated : 2025-06-17 20:01

NVD link : CVE-2024-21154

Mitre link : CVE-2024-21154

CVE.ORG link : CVE-2024-21154

JSON object : View

Products Affected

oracle

  • peoplesoft_enterprise_hcm_human_resources
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')