CVE-2022-21543

published 2022-07-19

CVE-2022-21543: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected…

Priority P3 57 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

4 ranges

Vendor	Product	Version range	Fixed in
oracle	peoplesoft_enterprise_peopletools	—	—
oracle	peoplesoft_enterprise_peopletools	—	—
oracle_corporation	peoplesoft_enterprise_pt_peopletools	—	—
oracle_corporation	peoplesoft_enterprise_pt_peopletools	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Vulnerability affects PeopleSoft Enterprise PeopleTools component 'Updates Environment Mgmt', exploitable over HTTP with no authentication required ↗
• → Successful exploitation results in full takeover; monitor PeopleSoft Updates Environment Mgmt endpoints for anomalous unauthenticated HTTP requests ↗
• → Affected versions are PeopleSoft Enterprise PeopleTools 8.58 and 8.59; prioritize patching or network-level blocking of HTTP access to these versions ↗

• · No authentication or user interaction is required, meaning the attack surface is entirely network-exposed; no special configuration is needed by the attacker ↗
• · Attack vector is Network with Low complexity and no privileges required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), meaning any internet-exposed PeopleSoft instance running affected versions is at maximum risk ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vendor_oracle 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.