Unauthenticated Remote Code Execution in Oracle PeopleSoft Enterprise PeopleTools

CVE-2022-21639

Summary

An unauthenticated vulnerability exists in Oracle's PeopleSoft Enterprise PeopleTools, specifically within the Elastic Search Integration component, that allows attackers with network access to exploit the system. Affected versions 8.59 and 8.60 permit unauthorized actions including updates, inserts, and deletions of accessible data, as well as unauthorized reading of certain data. Successful exploitation necessitates human interaction from a user other than the attacker, allowing for potential extensive impacts on additional interconnected products. Organizations are encouraged to review their configurations and apply necessary patches to mitigate risks associated with this vulnerability.

References