Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-3548 — XML External Entity (XXE) Injection in Corporation Peoplesoft Enterprise PT Peopletools

CWE-611 — XML External Entity (XXE) Injection6 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
49.2%
top 2.21%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Oracle Corporation Peoplesoft Enterprise PT PeopletoolsOracle Peoplesoft Enterprise Peopletools
Timeline
PublishedApr 24
Latest updateJul 19

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized abilit…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:LExploitability: 3.9 | Impact: 2.5

Affected Packages2 packages

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-xg3g-pprg-2wqw: Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker)↗2022-05-13
▶
CVEList
CVE-2017-3548: Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker)↗2017-04-24
▶

💥Exploits & PoCs

2
Exploit-DB
Oracle PeopleSoft Enterprise PeopleTools < 8.55 - Remote Code Execution Via Blind XML External Entity↗2017-05-17
▶
Exploit-DB
Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE↗2017-04-25
▶

💬Community

1
HackerOne
XXE with RCE potential on the https://█████████ (CVE-2017-3548)↗2024-07-19
▶
CVE-2017-3548 — XML External Entity (XXE) Injection | cvebase