CVE-2023-21916: Medium severity oracle peopletools vulnerability

Published Apr 18, 2023

Updated

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected Software

3 affected components

Oracle PeopleSoft Enterprise PeopleTools=8.58

Oracle PeopleSoft Enterprise PeopleTools=8.59

Oracle PeopleSoft Enterprise PeopleTools=8.60

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpuapr2023.html

Event History

Apr 18, 2023

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

DescriptionSeverity

Frequently Asked Questions

What is CVE-2023-21916?

CVE-2023-21916 is a vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server).

Which versions of Oracle PeopleSoft Enterprise PeopleTools are affected by CVE-2023-21916?

Versions 8.58, 8.59, and 8.60 of Oracle PeopleSoft Enterprise PeopleTools are affected by CVE-2023-21916.

What is the severity of CVE-2023-21916?

CVE-2023-21916 has a severity rating of 5.3, which is medium.

How can an attacker exploit CVE-2023-21916?

An unauthenticated attacker with network access via HTTP can easily exploit CVE-2023-21916.

Where can I find more information about CVE-2023-21916?

You can find more information about CVE-2023-21916 at the following link: [Oracle Security Alerts](https://www.oracle.com/security-alerts/cpuapr2023.html)