CVE-2018-3202: Medium severity oracle peopletools vulnerability

Published Oct 17, 2018

Updated

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected Software

2 affected components

Oracle PeopleSoft Enterprise PeopleTools=8.55

Oracle PeopleSoft Enterprise PeopleTools=8.56

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Event History

Oct 17, 2018

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-3202?

CVE-2018-3202 is classified as a high-severity vulnerability.

How do I fix CVE-2018-3202?

To fix CVE-2018-3202, update your Oracle PeopleSoft Enterprise PeopleTools to version 8.57 or later.

What component is affected by CVE-2018-3202?

CVE-2018-3202 affects the Performance Monitor component of Oracle PeopleSoft Enterprise PeopleTools.

Can CVE-2018-3202 be exploited remotely?

Yes, CVE-2018-3202 can be easily exploited by an unauthenticated attacker with network access via HTTP.

What versions of Oracle PeopleSoft are affected by CVE-2018-3202?

CVE-2018-3202 affects Oracle PeopleSoft Enterprise PeopleTools versions 8.55 and 8.56.