PeopleSoft PeopleTools CVE-2025-53055

Exploitation requires the PeopleSoft Internet Architecture (PIA) HTTP interface to be network-reachable by the attacker, which is the normal deployment mode for PeopleTools web access. The decisive limiting factor is mandatory human interaction (UI:R) from a victim other than the attacker - a legitimate PeopleSoft user must click a crafted link or load attacker-supplied content for the attack to fire; it cannot be triggered autonomously or at scale. No attacker authentication is needed (PR:N), and attack complexity is low (AC:L), but the user-interaction gate and the limited (low) confidentiality/integrity impact substantially constrain realistic risk. Affected deployments are limited to PeopleTools versions 8.60, 8.61 and 8.62.

This is a moderate-priority issue, not an emergency. The CVSS 3.1 base score is 6.1 (medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - network-reachable and unauthenticated (PR:N), but gated by required user interaction (UI:R), which materially limits automatability. The EPSS score is very low at 0.25% (15th percentile), and the vulnerability is NOT in CISA KEV and has no publicly identified exploit code, so all exploitation signals point to low near-term real-world risk. The one aggravating factor is the scope change (S:C): Oracle states attacks 'may significantly impact additional products,' so a successful attack can cross the PeopleTools trust boundary. Note a classification tension worth verifying with the vendor: the assigned CWE-125 (out-of-bounds read) and the 'Buffer Overflow' tag imply a memory-safety defect, yet the CVSS profile (UI:R + S:C + low confidentiality/integrity + no availability impact) is far more consistent with a reflected injection/cross-site-scripting-style flaw than a classic memory-corruption bug - the two signals conflict and the true defect class is not independently confirmed. Overall: low exploitation probability plus a medium severity and mandatory user interaction make this a routine-patch item rather than a drop-everything priority.

An attacker crafts a malicious HTTP request or link targeting the PeopleSoft Internet Architecture (PIA) interface and lures an authenticated PeopleSoft user into clicking it or loading it in their browser. When the victim interacts, the flaw triggers in the PIA Core Technology layer, letting the attacker read a subset of accessible data and perform limited unauthorized update/insert/delete actions in the victim's context, with potential impact reaching additional products due to the scope change. No public exploit code or active exploitation has been identified at time of analysis.