Unauthorized Data Access and Partial DoS in PeopleSoft Fluid Core

Compliance Impact

This vulnerability allows a high privileged attacker with network access to compromise PeopleSoft Enterprise PeopleTools, resulting in unauthorized read, update, insert, or delete access to accessible data, as well as partial denial of service.

Such unauthorized access and potential data manipulation could lead to violations of data protection regulations and standards such as GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.

Therefore, exploitation of this vulnerability may negatively impact compliance with these common standards and regulations by exposing sensitive data or disrupting service availability.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the PeopleSoft Enterprise PeopleTools product, specifically in the Fluid Core component, affecting versions 8.61 to 8.62.

It is easily exploitable by a high privileged attacker who has network access via HTTP.

The attacker can compromise PeopleSoft Enterprise PeopleTools, potentially impacting additional related products.

Successful exploitation can lead to unauthorized update, insert, or delete operations on accessible data, unauthorized read access to some data, and the ability to cause a partial denial of service (partial DOS) on the PeopleTools system.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker with high privileges and network access to:

• Unauthorized modification (update, insert, delete) of accessible data within PeopleSoft Enterprise PeopleTools.
• Unauthorized reading of a subset of accessible data.
• Cause a partial denial of service (partial DOS) affecting the availability of PeopleSoft Enterprise PeopleTools.

These impacts affect the confidentiality, integrity, and availability of the system, potentially disrupting business operations and compromising sensitive information.

Useful 0 Not Useful 0