CVE-2019-2748: High severity oracle peopletools vulnerability
Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Application Server). Supported versions that are affected are 8.55, 8.56 and 8.57. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. While the vulnerability is in PeopleSoft Enterprise PT PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PT PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PT PeopleTools accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-2748?
CVE-2019-2748 is classified as a moderate severity vulnerability.
How do I fix CVE-2019-2748?
To fix CVE-2019-2748, apply the latest security patches provided by Oracle for the affected versions.
Who is affected by CVE-2019-2748?
CVE-2019-2748 affects users of Oracle PeopleSoft Enterprise PT PeopleTools versions 8.55, 8.56, and 8.57.
What components are impacted by CVE-2019-2748?
CVE-2019-2748 impacts the Application Server component of the PeopleSoft Enterprise PT PeopleTools.
Can CVE-2019-2748 be exploited remotely?
Yes, CVE-2019-2748 can be exploited by a low privileged attacker with network access via HTTP.