Multiple vulnerabilities in Oracle PeopleSoft Enterprise PRTL Interaction Hub

Published: 2017-10-19 | Updated: 2020-08-08

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2017-10354 CVE-2017-10338
CWE-ID	CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	PeopleSoft Enterprise PRTL Interaction Hub Client/Desktop applications / Office applications
Vendor	Oracle

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU38036

Risk: High

CVSSv4.0: 4.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-10354

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Enterprise Portal). The supported version that is affected is 9.1.00. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Mitigation

Install update from vendor's website.

Vulnerable software versions

PeopleSoft Enterprise PRTL Interaction Hub: 9.1.00

CPE2.3