CVE-2018-2809: Medium severity oracle peopletools vulnerability

Published Apr 19, 2018

Updated

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Homepage & Navigation). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).

Affected Software

3 affected components

Oracle PeopleSoft Enterprise PeopleTools=8.54

Oracle PeopleSoft Enterprise PeopleTools=8.55

Oracle PeopleSoft Enterprise PeopleTools=8.56

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Event History

Apr 19, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2809?

CVE-2018-2809 is considered an easily exploitable vulnerability that allows unauthenticated attackers network access via HTTP.

How do I fix CVE-2018-2809?

To mitigate CVE-2018-2809, it is recommended to apply the latest security patches provided by Oracle for affected PeopleSoft versions.

What versions are affected by CVE-2018-2809?

CVE-2018-2809 affects Oracle PeopleSoft Enterprise PeopleTools versions 8.54, 8.55, and 8.56.

Is there any workaround for CVE-2018-2809?

Temporary workarounds for CVE-2018-2809 may include restricting HTTP access to the vulnerable application until a patch can be applied.

Who can exploit CVE-2018-2809?

CVE-2018-2809 can be exploited by unauthenticated attackers with network access via HTTP.