Unauthenticated Vulnerability in Oracle PeopleSoft Enterprise HRMS Allows Data Compromise

CVE-2020-2954

Summary

An exploitable vulnerability has been identified in the Candidate Gateway of Oracle's PeopleSoft Enterprise HRMS (version 9.2). This flaw allows an unauthenticated attacker with network access via HTTP to potentially compromise the system. The vulnerability necessitates human interaction from an external individual to successfully execute attacks. Exploitation can result in unauthorized updates, insertions, deletions, and read access to sensitive data, impacting both confidentiality and integrity of the data within PeopleSoft Enterprise HRMS. Mitigation strategies are essential to safeguard affected data and ensure continued compliance with security protocols.

References