{"id":"CVE-2017-3546","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-3546","generatedAt":"2026-10-28T20:47:57.444Z","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework).","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","published":"2017-04-24T19:59:04.000Z","lastModified":"2026-06-17T01:18:33.000Z","status":"Modified","sourceIdentifier":"secalert_us@oracle.com","cvss":{"version":"3.0","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-918"],"affected":["oracle/peoplesoft enterprise peopletools"],"epss":{"score":0.09636,"percentile":0.95461,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.13335,"percentile":0.96291},{"date":"2026-09-22","score":0.09636,"percentile":0.95266}]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2017-05-19","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":42034,"kind":"exploit","title":"Oracle PeopleSoft - Server-Side Request Forgery","url":"https://www.exploit-db.com/exploits/42034","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/java/webapps/42034.txt","file":"exploits/java/webapps/42034.txt","published":"2017-05-19","added":"2017-05-19","updated":"2017-05-19","author":"ERPScan","type":"webapps","platform":"java","port":null,"verified":false,"codes":["CVE-2017-3546"],"tags":"Server-Side Request Forgery (SSRF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"high","text":"A public exploit is published in Exploit-DB, so the technical barrier is gone even though the severity is medium and EPSS is 9.6%. Treat it as high on anything reachable from the internet."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-21T00:00:00.000Z","detail":{"to":0.13335,"from":0.09636,"percentile":0.96291},"summary":"EPSS moved from 9.6% to 13.3% probability of exploitation in the next thirty days."}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","tags":["Patch","Vendor Advisory"],"source":"secalert_us@oracle.com"},{"url":"http://www.securityfocus.com/bid/97872","tags":["Third Party Advisory","VDB Entry"],"source":"secalert_us@oracle.com"},{"url":"http://www.securitytracker.com/id/1038301","tags":["Third Party Advisory","VDB Entry"],"source":"secalert_us@oracle.com"},{"url":"https://erpscan.io/advisories/erpscan-17-022-ssrf-peoplesoft-imservlet/","tags":["Third Party Advisory"],"source":"secalert_us@oracle.com"},{"url":"https://www.exploit-db.com/exploits/42034/","tags":["Third Party Advisory","VDB Entry"],"source":"secalert_us@oracle.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/97872","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1038301","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://erpscan.io/advisories/erpscan-17-022-ssrf-peoplesoft-imservlet/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/42034/","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-3546","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}