Peoplesoft Enterprise Campus Software Campus Community
CVE-2019-2493
LOW
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the PeopleSoft Enterprise CS Campus Community component of Oracle PeopleSoft Products (subcomponent: Frameworks). Supported versions that are affected are 9.0 and 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
AnalysisAI
Vulnerability in the PeopleSoft Enterprise CS Campus Community component of Oracle PeopleSoft Products (subcomponent: Frameworks). Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required.
Technical ContextAI
Vulnerability in the PeopleSoft Enterprise CS Campus Community component of Oracle PeopleSoft Products (subcomponent: Frameworks). Supported versions that are affected are 9.0 and 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). Affected products include: Oracle Peoplesoft Enterprise Campus Software Campus Community.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Privilege-escalating takeover of Oracle PeopleSoft Enterprise CS Student Records (Campus Solutions) 9.2.38, specifically
Account takeover in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Integration and Interfaces component) lets
Unauthenticated data compromise in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) lets rem
Data compromise in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Research Tracking component) lets a low-privi
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Higher Ed Statistics Agency - UK
Full takeover of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 is possible for a low-privileged attacker with
Full compromise of Oracle PeopleSoft Enterprise CS Student Records version 9.2.38 (Research Tracking component) allows a
Data manipulation and denial-of-service in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Person Data componen
Full system takeover is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking com
Unauthorized data access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a low-privileged authenticate
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 exposes sensitive student and instituti
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows unauthenticated network a
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today