PeopleSoft PeopleTools CVE-2025-53059

Exploitation requires a high-privileged, authenticated PeopleTools account (CVSS PR:H) with network HTTP access to the deployment; the vulnerable OpenSearch Dashboards component must be enabled and reachable. No user interaction is needed and attack complexity is low once those conditions are met. The primary limiting factors are the high-privilege prerequisite - which confines realistic exploitation to malicious insiders or attackers who have already compromised a privileged account - and applicability only to PeopleTools versions 8.60, 8.61, and 8.62.

This is a moderate-severity information-disclosure issue (CVSS 3.1 base 4.9) whose real-world priority is tempered by its privilege requirement. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N confirms network reachability over HTTP and low attack complexity, but PR:H means the attacker must already hold a high-privileged PeopleTools account - a significant limiting factor that keeps this out of the 'remote unauthenticated' danger class despite Oracle's 'easily exploitable' wording. Impact is confidentiality-only (C:H, I:N, A:N): data theft, not tampering or outage. Supporting signals reinforce the lower-priority read: EPSS is 0.37% (29th percentile), indicating low predicted exploitation likelihood; the CVE is NOT in CISA KEV; and no public exploit code is referenced. One notable conflict: the input carries an 'Authentication Bypass' tag, which is inconsistent with a vector that explicitly requires PR:H (high privileges) and with the CWE-284 (improper access control) classification - the vulnerability appears to be a post-authentication access-control/data-exposure flaw in the OpenSearch Dashboards component, not a true authentication bypass; verify the tag against Oracle's advisory. Overall: a real but not urgent issue, best handled via the normal Oracle CPU patch cycle rather than emergency remediation.

An attacker who already possesses a high-privileged PeopleTools account (or has compromised one) sends crafted HTTP requests to the embedded OpenSearch Dashboards component and abuses improper access controls to read critical PeopleSoft data they should not be able to reach. No user interaction is required and attack complexity is low, but the high-privilege prerequisite means this is most realistic as an insider or post-compromise privilege-abuse scenario; no public proof-of-concept exploit is referenced.