CVE-2025-50062 in PeopleSoft Enterprise HCM Global Payroll Core
Summary
by MITRE • 07/15/2025
Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). Supported versions that are affected are 9.2.51 and 9.2.52. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Global Payroll Core. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Global Payroll Core accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Global Payroll Core accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2025
This vulnerability exists within Oracle PeopleSoft Enterprise HCM Global Payroll Core component version 9.2.51 and 9.2.52, representing a critical security flaw that enables low-privileged attackers to compromise sensitive payroll data through network-based HTTP access. The vulnerability's exploitability is classified as easily accessible, meaning that an attacker with minimal privileges and network connectivity can potentially execute successful attacks against the system. The affected component specifically relates to the Global Payroll for Core functionality within the broader PeopleSoft HCM suite, which handles critical financial and employee compensation data processing.
The technical nature of this vulnerability stems from insufficient access controls and authentication mechanisms within the payroll processing framework, allowing attackers to perform unauthorized data manipulation operations including creation, deletion, and modification of critical payroll records. The CVSS 3.1 scoring of 8.1 indicates high severity with significant impacts to both confidentiality and integrity, where the attacker can potentially access all accessible data within the payroll system. The attack vector requires only network access via HTTP protocol, making it particularly dangerous as it can be exploited from remote locations without requiring physical system access or elevated privileges. The vulnerability's impact extends beyond simple data exposure to include complete data modification capabilities, potentially allowing attackers to alter employee compensation, tax withholdings, or other critical payroll information.
From an operational standpoint, this vulnerability poses severe risks to organizations relying on PeopleSoft HCM for payroll processing, as it could enable financial fraud, compliance violations, and data integrity breaches that may affect thousands of employees. The low privilege requirement means that even users with minimal system access could potentially exploit this vulnerability, making it particularly concerning for organizations with less stringent access controls. The confidentiality impact is rated as high because attackers can access all payroll data accessible through the system, potentially including sensitive personal information, salary details, and tax information. The integrity impact is equally severe as attackers can modify critical data, potentially leading to incorrect payroll processing and financial losses. Organizations utilizing these specific PeopleSoft versions should immediately implement security patches or workarounds as recommended by Oracle to prevent exploitation.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a significant deviation from the principle of least privilege, where proper authorization checks fail to prevent unauthorized operations. The ATT&CK framework categorizes this as a privilege escalation technique, specifically mapping to T1078 (Valid Accounts) and T1566 (Phishing) as attackers may leverage compromised accounts to exploit this weakness. Organizations should consider implementing network segmentation, enhanced monitoring of payroll system access, and additional authentication controls to mitigate the risk of exploitation. The vulnerability also highlights the importance of regular security assessments and patch management processes, particularly for enterprise applications handling sensitive financial data. Given the high CVSS score and the potential for financial damage, this vulnerability should be prioritized for immediate remediation alongside other critical security issues in the organization's security posture.