CVE-2018-2653: Medium severity oracle peopletools vulnerability

Published Jan 18, 2018

Updated

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Connected Query). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected Software

3 affected components

Oracle PeopleSoft Enterprise PeopleTools=8.54

Oracle PeopleSoft Enterprise PeopleTools=8.55

Oracle PeopleSoft Enterprise PeopleTools=8.56

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Event History

Jan 18, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2653?

CVE-2018-2653 is considered a high severity vulnerability due to its potential for exploitation by unauthenticated attackers.

How do I fix CVE-2018-2653?

To remediate CVE-2018-2653, it is advised to apply the latest patches provided by Oracle for affected versions 8.54, 8.55, and 8.56.

Who is affected by CVE-2018-2653?

CVE-2018-2653 affects users of Oracle PeopleSoft Enterprise PeopleTools versions 8.54, 8.55, and 8.56.

Can CVE-2018-2653 be exploited remotely?

Yes, CVE-2018-2653 can be exploited remotely over HTTP by unauthenticated attackers.

What component is vulnerable in CVE-2018-2653?

CVE-2018-2653 involves a vulnerability in the Connected Query subcomponent of Oracle PeopleSoft Enterprise PeopleTools.