PeopleSoft PeopleTools CVE-2025-53048

Exploitation requires a valid low-privileged PeopleSoft Enterprise PeopleTools account (PR:L) capable of submitting content through the Rich Text Editor component, and critically depends on a second human victim (UI:R) subsequently viewing or rendering the attacker-supplied content - the attacker cannot trigger the flaw alone. Affected deployments are limited to PeopleTools versions 8.60, 8.61, and 8.62. These factors (authentication plus required interaction from a distinct user) substantially limit realistic, large-scale exploitation; the scope change (S:C) means impact may extend to products integrated with PeopleTools beyond the editor itself.

This is a moderate-severity, low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a network-reachable but constrained flaw: it requires an authenticated low-privileged attacker (PR:L) AND human interaction from a different user (UI:R), and yields only partial confidentiality and integrity impact with no availability loss. The scope change (S:C) plus UI:R and the Rich Text Editor component strongly suggest a stored cross-site-scripting-style issue where an attacker plants content that executes in a victim's session - note, however, that the assigned weakness is CWE-125 (out-of-bounds read) and a 'Buffer Overflow' tag is present, which conflicts with that XSS reading; the generic Oracle CPU description does not resolve this, so the true mechanism should be verified with Oracle. Real-world exploitation signals are low and mutually consistent: EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code is referenced. The dual requirement of valid credentials and a second human victim meaningfully lowers practical risk below what the 'network' vector alone implies. Overall this is a patch-in-normal-cycle item, not an emergency.

A low-privileged but authenticated PeopleSoft user submits crafted content through the Rich Text Editor; when a higher-value user (e.g., an administrator or another employee) later views that content, the payload executes in their session, enabling limited unauthorized read and modification of data the victim can access, with the scope change potentially affecting linked products. No public exploit code is referenced, and success depends on luring a second user to view the malicious content.