Preeyakorn Keadsai

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise HCM Global Payroll Core version 9.2 Description: The issue is related to insufficient input validation in the Security component of the PeopleSoft Enterprise HCM Global Payroll Core application. This can be exploited by a remote attacker to gain unauthorized access to protected information, modify, add, or delete data, or cause a denial of service. The vulnerability can be easily exploited by a low-privileged attacker with network access via HTTP, allowing them to compromise the PeopleSoft Enterprise HCM Global Payroll Core product. Successful attacks can result in unauthorized access to some data, including read access to a subset of data and the ability to cause a partial denial of service. Recommendations: For version 9.2, update the Security component to a version that includes the necessary input validation checks to prevent exploitation. As a temporary workaround, consider restricting access to the Security component until a patch is available. Avoid using the HTTP protocol to access the PeopleSoft Enterprise HCM Global Payroll Core product until the issue is resolved.

The issue is related to insufficient input validation in the Environment Mgmt Console component. It allows a high-privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, resulting in unauthorized update, insert, or delete access to some accessible data. The vulnerability can be easily exploited and may cause the application to become unresponsive or allow unauthorized data access.

The issue is related to insufficient input validation in the Portal component of Oracle PeopleSoft Enterprise PeopleTools. This allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, resulting in unauthorized read access to a subset of accessible data.