Peoplesoft Enterprise Cs Student Records
Monthly
Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component over HTTP. An unauthenticated network attacker exploiting an authentication bypass condition (tagged explicitly by the reporter) can retrieve confidential academic data without credentials, though the high attack complexity constrains opportunistic mass exploitation. No public exploit code or active exploitation has been identified; however, even partial disclosure of student records carries regulatory significance under FERPA regardless of the low CVSS score of 3.7.
Unauthorized read access to student records data in Oracle PeopleSoft Enterprise CS Student Records 9.2 (Research Tracking component) can be triggered by a low-privileged authenticated attacker over HTTP, provided a victim user interacts with attacker-controlled content. The flaw is rooted in improper access control (CWE-284), enabling horizontal or vertical privilege escalation within the application to expose the full scope of student records data. No public exploit exists and EPSS is extremely low at 0.03% (9th percentile), though the confidentiality impact is rated High by Oracle given the breadth of data potentially accessible.
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Class Search). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component over HTTP. An unauthenticated network attacker exploiting an authentication bypass condition (tagged explicitly by the reporter) can retrieve confidential academic data without credentials, though the high attack complexity constrains opportunistic mass exploitation. No public exploit code or active exploitation has been identified; however, even partial disclosure of student records carries regulatory significance under FERPA regardless of the low CVSS score of 3.7.
Unauthorized read access to student records data in Oracle PeopleSoft Enterprise CS Student Records 9.2 (Research Tracking component) can be triggered by a low-privileged authenticated attacker over HTTP, provided a victim user interacts with attacker-controlled content. The flaw is rooted in improper access control (CWE-284), enabling horizontal or vertical privilege escalation within the application to expose the full scope of student records data. No public exploit exists and EPSS is extremely low at 0.03% (9th percentile), though the confidentiality impact is rated High by Oracle given the breadth of data potentially accessible.
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Class Search). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.