CVE-2024-21097: Medium severity oracle peopletools vulnerability

Published Apr 16, 2024

Updated

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.59, 8.60 and 8.61. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

Affected Software

3 affected components

Oracle PeopleSoft Enterprise PeopleTools=8.59

Oracle PeopleSoft Enterprise PeopleTools=8.60

Oracle PeopleSoft Enterprise PeopleTools=8.61

Event History

Apr 16, 2024

CVE Published

via MITRE·09:26 PM

Data Sourced

via MITRE·09:26 PM

DescriptionSeverity

Data Sourced

via NVD·10:15 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2024-21097?

CVE-2024-21097 is rated as a high severity vulnerability due to its potential for exploitation by high privileged attackers.

How do I fix CVE-2024-21097?

To fix CVE-2024-21097, Oracle recommends applying the latest security patches available for the affected PeopleSoft Enterprise PeopleTools versions.

What are the affected versions in CVE-2024-21097?

CVE-2024-21097 affects Oracle PeopleSoft Enterprise PeopleTools versions 8.59, 8.60, and 8.61.

Who can exploit CVE-2024-21097?

CVE-2024-21097 can be exploited by high privileged attackers with network access via HTTP.

What component is affected by CVE-2024-21097?

CVE-2024-21097 affects the Security component of the Oracle PeopleSoft Enterprise PeopleTools product.