Unauthorized Access Vulnerability in Oracle PeopleSoft SCM eProcurement

CVE-2021-2220

What is CVE-2021-2220?

An easily exploitable vulnerability exists in Oracle PeopleSoft's Enterprise SCM eProcurement component, affecting version 9.2. This flaw allows a low privileged attacker to gain unauthorized access to sensitive data through network access via HTTP. Successful exploitation may enable the attacker to perform unauthorized updates, inserts, or deletions of accessible data, as well as read access to restricted information. This vulnerability can compromise both the confidentiality and integrity of the data managed by PeopleSoft Enterprise SCM eProcurement.

References