CVE-2021-2377: Medium severity oracle peopletools vulnerability

Published Jul 20, 2021

Updated

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Affected Software

3 affected components

Oracle PeopleSoft Enterprise PeopleTools=8.57

Oracle PeopleSoft Enterprise PeopleTools=8.58

Oracle PeopleSoft Enterprise PeopleTools=8.59

Event History

Jul 20, 2021

CVE Published

via MITRE·10:43 PM

Data Sourced

via MITRE·10:43 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-2377?

CVE-2021-2377 is considered to have a high severity level due to its easily exploitable nature.

How do I fix CVE-2021-2377?

To fix CVE-2021-2377, you should upgrade your Oracle PeopleSoft Enterprise PeopleTools to the latest patched version.

Who is affected by CVE-2021-2377?

Organizations using Oracle PeopleSoft Enterprise PeopleTools versions 8.57, 8.58, or 8.59 are affected by CVE-2021-2377.

What type of attackers can exploit CVE-2021-2377?

CVE-2021-2377 can be exploited by low privileged attackers with network access via HTTP.

What component of PeopleSoft does CVE-2021-2377 affect?

CVE-2021-2377 specifically affects the SQR component of Oracle PeopleSoft Enterprise PeopleTools.