PeopleSoft PeopleTools CVE-2025-53065

Exploitation targets the PeopleSoft Internet Architecture (PIA) Core Technology component of PeopleTools 8.60, 8.61, and 8.62 over HTTP. The decisive limiting factor is required user interaction (UI:R): a victim other than the attacker must perform an action (e.g., follow a crafted link or load attacker-controlled content) for the attack to succeed, which rules out fully automated, drive-by mass exploitation. No authentication is required (PR:N) and attack complexity is low (AC:L), so no special privileges or non-default configuration are stated as prerequisites; the description does not name a specific feature toggle that must be enabled. Impact is bounded to a subset of PeopleTools-accessible data (low read) and some data (low update/insert/delete), with no availability impact.

This is a moderate-severity issue (CVSS 3.1 base 5.4) that is unlikely to be a top patching priority despite affecting a high-value enterprise ERP platform. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated flaw, but the mandatory user-interaction requirement (UI:R - 'Successful attacks require human interaction from a person other than the attacker') meaningfully constrains real-world exploitation and is the single most risk-limiting signal. Impact is partial: low confidentiality (read of a subset of data) and low integrity (unauthorized update/insert/delete of some data), with no availability impact. The exploitation-probability signals align with the modest score: EPSS is 0.25% (15th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept was identified - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a classification tension: the assigned CWE is CWE-125 (out-of-bounds read, an information-disclosure/memory-read weakness), yet the input Tags include 'Buffer Overflow' and the description also claims write-side impact (update/insert/delete), which an out-of-bounds READ alone would not typically produce - the underlying root cause may be broader than CWE-125 suggests; verify the precise weakness with Oracle. No full SSVC decision data was provided; based on available signals, exploitation status is 'none/public-PoC-absent', automatable is likely 'no' (requires victim interaction), and technical impact is 'partial'. Overall: a real but second-tier item - schedule in the normal Oracle Critical Patch Update cycle rather than treating as an emergency.

An attacker hosts or delivers a malicious link/page and lures an authenticated or unauthenticated PeopleSoft user (a person other than the attacker) into clicking it or loading attacker-influenced content, causing their browser to issue a crafted HTTP request to the PeopleSoft Internet Architecture (PIA) Core Technology layer. The request triggers an out-of-bounds condition that leaks a subset of accessible data and permits limited unauthorized modification of some PeopleTools data. No public exploit code was identified, so exploitation would currently require independent development.