CVE-2018-2820: Medium severity oracle peopletools vulnerability

Published Apr 19, 2018

Updated

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Fluid Core). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected Software

3 affected components

Oracle PeopleSoft Enterprise PeopleTools=8.54

Oracle PeopleSoft Enterprise PeopleTools=8.55

Oracle PeopleSoft Enterprise PeopleTools=8.56

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Event History

Apr 19, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2820?

CVE-2018-2820 is considered a moderate severity vulnerability.

How do I fix CVE-2018-2820?

To fix CVE-2018-2820, apply the latest patches provided by Oracle for affected PeopleSoft versions.

Which versions are affected by CVE-2018-2820?

CVE-2018-2820 affects PeopleSoft Enterprise PeopleTools versions 8.54, 8.55, and 8.56.

Who can exploit CVE-2018-2820?

CVE-2018-2820 can be exploited by low privileged attackers with network access via HTTP.

What component is impacted by CVE-2018-2820?

CVE-2018-2820 impacts the Fluid Core subcomponent of the PeopleSoft Enterprise PeopleTools.