VulnerabilityModified

CVE-2017-3547

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework).

HIGH 7.4EPSS 2.15%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).

CVSS 3.0: 7.4 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
EPSS: 2.15% probability · 81th percentile
CISA KEV: Not listed
Weakness: CWE-74
Affected: oracle/peoplesoft enterprise peopletools
Source: secalert_us@oracle.com

References

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/97892Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038301Third Party Advisory, VDB Entry
https://erpscan.io/advisories/erpscan-17-023-crlf-injection-peoplesoft-imservlet/Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/97892Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038301Third Party Advisory, VDB Entry
https://erpscan.io/advisories/erpscan-17-023-crlf-injection-peoplesoft-imservlet/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.