CVE-2023-44483 in PeopleSoft Enterprise PeopleTools

Summary

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Reservation

09/29/2023

Disclosure

10/25/2023

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
251293	Oracle PeopleSoft Enterprise PeopleTools Security information disclosure	200	Not defined	Official fix	CVE-2023-44483
251187	Oracle WebLogic Server Centralized Thirdparty Jars information disclosure	200	Not defined	Official fix	CVE-2023-44483
251186	Oracle WebCenter Portal Discussion Forums information disclosure	200	Not defined	Official fix	CVE-2023-44483
251144	Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition Platform information disclosure	200	Not defined	Official fix	CVE-2023-44483
251142	Oracle Financial Services Behavior Detection Platform Application information disclosure	200	Not defined	Official fix	CVE-2023-44483
251140	Oracle Financial Services Analytical Applications Infrastructure information disclosure	200	Not defined	Official fix	CVE-2023-44483
251042	Oracle Communications Cloud Native Core Console Configuration information disclosure	200	Not defined	Official fix	CVE-2023-44483
250989	Oracle Communications Service Catalog and Design PSR Designer information disclosure	200	Not defined	Official fix	CVE-2023-44483
243052	Apache Santuario XML Security for Java JSR 105 API log file	532	Not defined	Official fix	CVE-2023-44483

Sources

• MITRE
• NVD
• CVE Details