CVE-2024-21214

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21214
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.59, 8.60 and 8.61. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.oracle.com/security-alerts/cpuoct2024.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*
History

18 Oct 2024, 18:16

Type Values Removed Values Added
References () https://www.oracle.com/security-alerts/cpuoct2024.html - () https://www.oracle.com/security-alerts/cpuoct2024.html - Vendor Advisory
CPE cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*
First Time Oracle peoplesoft Enterprise Peopletools
Oracle
CWE NVD-CWE-noinfo

16 Oct 2024, 16:38

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad en el producto PeopleSoft Enterprise PeopleTools de Oracle PeopleSoft (componente: Query). Las versiones compatibles afectadas son 8.59, 8.60 y 8.61. Esta vulnerabilidad, que se puede explotar fácilmente, permite que un atacante con pocos privilegios y acceso a la red a través de HTTP comprometa PeopleSoft Enterprise PeopleTools. Los ataques exitosos de esta vulnerabilidad pueden dar como resultado la creación, eliminación o modificación no autorizada de datos críticos o de todos los datos accesibles de PeopleSoft Enterprise PeopleTools, así como el acceso no autorizado a datos críticos o al acceso completo a todos los datos accesibles de PeopleSoft Enterprise PeopleTools. Puntuación base de CVSS 3.1: 8,1 (impactos en la confidencialidad y la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

15 Oct 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-15 20:15

Updated : 2024-10-18 18:16

NVD link : CVE-2024-21214

Mitre link : CVE-2024-21214

CVE.ORG link : CVE-2024-21214

JSON object : View

Products Affected

oracle

  • peoplesoft_enterprise_peopletools
CWE
NVD-CWE-noinfo