CVE-2022-21602 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/19/2022
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/26/2026
The CVE-2022-21602 vulnerability represents a significant security weakness within Oracle PeopleSoft Enterprise PeopleTools, specifically affecting the Portal component across versions 8.58, 8.59, and 8.60. This vulnerability falls under the Common Weakness Enumeration category CWE-284, which deals with improper access control mechanisms, making it a critical concern for organizations relying on PeopleSoft platforms for enterprise resource planning and business process management. The flaw manifests as an insufficient authorization check that allows unauthenticated attackers to access sensitive data within the PeopleTools environment, potentially exposing confidential business information and operational details to malicious actors.
The technical nature of this vulnerability stems from inadequate authentication mechanisms within the Portal component of PeopleSoft Enterprise PeopleTools, creating a pathway for network-based attacks that require no prior credentials or privileged access. Attackers can exploit this weakness through standard HTTP network connections, leveraging the vulnerability's low attack complexity and lack of required privileges to gain unauthorized access to a subset of accessible data. The CVSS 3.1 scoring system rates this vulnerability with a base score of 5.3, indicating a medium severity threat that primarily impacts confidentiality without affecting integrity or availability. The vulnerability's vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) demonstrates that it can be exploited remotely over the network with low complexity, requires no user interaction, and affects the entire system without requiring privileged access.
The operational impact of this vulnerability extends beyond simple data exposure, as it can compromise the integrity of business processes and sensitive enterprise information that organizations rely on for day-to-day operations. Organizations using affected PeopleSoft versions may face unauthorized access to employee data, financial records, customer information, and other confidential business assets. This vulnerability particularly affects enterprises that depend heavily on PeopleSoft for critical business functions, potentially leading to competitive disadvantages, regulatory compliance issues, and financial losses due to data breaches. The lack of authentication requirements makes this vulnerability especially dangerous as it can be exploited by anyone with network access to the affected systems, creating a broad attack surface that extends beyond traditional internal network boundaries.
Organizations should implement immediate mitigation strategies including applying the relevant Oracle security patches and updates as soon as they become available, implementing network segmentation to limit access to PeopleSoft components, and establishing enhanced monitoring protocols for unauthorized access attempts. Additional protective measures should include configuring firewalls to restrict HTTP access to PeopleSoft systems, implementing network access controls, and conducting regular vulnerability assessments to identify potential exploitation vectors. The vulnerability aligns with ATT&CK technique T1071.004, which involves application layer protocol usage for data exfiltration, making it critical for security teams to monitor for unusual data access patterns and implement proper access controls. Regular security assessments and maintaining updated security configurations are essential to prevent exploitation of this and similar vulnerabilities in enterprise environments.