CVE-2017-3548
published 2017-04-24CVE-2017-3548: Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are…
PriorityP358medium6.5CVSS 3.0
AVNACLPRNUINSUCLINAL
EXPLOIT
EPSS
50.84%
98.8th percentile
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle | peoplesoft_enterprise_peopletools | — | — |
| oracle_corporation | peoplesoft_enterprise_pt_peopletools | — | — |
| oracle_corporation | peoplesoft_enterprise_pt_peopletools | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Oracle PeopleSoft Enterprise PeopleTools < 8.55 - Remote Code Execution Via Blind XML External Entity
exploitdb·2017-05-17
CVE-2017-3548 Oracle PeopleSoft Enterprise PeopleTools < 8.55 - Remote Code Execution Via Blind XML External Entity
Oracle PeopleSoft Enterprise PeopleTools '
class Browser:
"""Wrapper around requests.
"""
def __init__(self, url):
self.url = url
self.init()
def init(self):
self.session = requests.Session()
self.session.proxies = {
'http': PROXY,
'https': PROXY
}
self.session.verify = False
def get(self, url ,*args, **kwargs):
return self.session.get(url=self.url + url, *args, **kwargs)
def post(self, url, *args, **kwargs):
return self.session.post(url=self.url + url, *args, **kwargs)
def matches(self, r, regex):
return re.findall(regex, r.text)
class Recon(Browser):
"""Grabs different informations about the target.
"""
def check_all(self):
self.site_id = None
self.local_port = None
self.check_version()
self.check_site_id()
self.check_local_infos()
def check_version(self):
"""Grabs PeopleTools
Exploit-DB
Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE
exploitdb·2017-04-25·CVSS 6.5
CVE-2017-3548 [MEDIUM] Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE
Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE
---
Application: Oracle PeopleSoft
Versions Affected: PeopleSoft HCM 9.2 on PeopleTools 8.55
Vendor URL: http://oracle.com
Bug: XXE
Reported: 23.12.2016
Vendor response: 24.12.2016
Date of Public Advisory: 18.04.2017
Reference: Oracle CPU April 2017
Author: Nadya Krivdyuk (ERPScan)
Description
1. ADVISORY INFORMATION
Title:[ERPSCAN-17-020] XXE VIA DOCTYPE in PeopleSoft
PeopleSoftServiceListeningConnector
Advisory ID: [ERPSCAN-17-020]
Risk: high
CVE: CVE-2017-3548
Advisory URL: https://erpscan.com/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft/
Date published: 18.04.2017
Vendors contacted: Oracle
2. VULNERABILITY INFORMATION
Class: XXE
Impact: File disclosure, network discovery
Remotely E
HackerOne
XXE with RCE potential on the https://█████████ (CVE-2017-3548)
hackerone·2024-07-19·CVSS 6.5
CVE-2017-3548 [MEDIUM] XXE with RCE potential on the https://█████████ (CVE-2017-3548)
XXE with RCE potential on the https://█████████ (CVE-2017-3548)
##Description
Hello. I was able to identify XXE on the https://███████
It is CVE in Oracle PeopleSoft (CVE-2017-3548)
##POC
I determined that instance is available on localhost port 80, so it's possible to access `/pspc/services/AdminService` via XXE:
```
POST /PSIGW/PeopleSoftServiceListeningConnector HTTP/1.1
Host: ████████
Content-Type: application/xml
Content-Length: 608
```
where `h1testservice` is test service name I'm trying to create.
The result:
```
https://██████████/pspc/services/h1testservice
```
█████
I created new service on server.
It's possible to go further like other researcher did in the #227880 but I don't think that dropping shell is necessary (since it's already proved that we can create our Apache
Rapid7
Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
blogs_rapid7·2026-06-12·CVSS 9.8
CVE-2026-35273 [CRITICAL] Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)
## Overview
On June 10, 2026, Oracle published a security alert for CVE-2026-35273 , a critical vulnerability in the Updates Environment Management component of PeopleSoft Enterprise PeopleTools. Oracle released an out-of-band patch the same day as the advisory, underscoring the urgency of remediation. The vulnerability has a CVSSv3.1 score of 9.8 and is remotely exploitable without authentication. Per the vendor advisory, successful exploitation may result in remote code execution (RCE). TrendAI has classified the underlying flaw as a server-side request forgery ( CWE-918 ). PeopleTools versions 8.61 and 8.62 are affected.
CVE-2026-35273 was reported to Oracle through TrendAI's Zero Day Initiative. According to a report published by Mandiant on June 11, 2026, this vulnerability has been
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlhttp://www.securityfocus.com/bid/97880http://www.securitytracker.com/id/1038301https://erpscan.io/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft/https://www.exploit-db.com/exploits/41925/http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlhttp://www.securityfocus.com/bid/97880http://www.securitytracker.com/id/1038301https://erpscan.io/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft/https://www.exploit-db.com/exploits/41925/
2017-04-24
Published