{"id":"CVE-2023-22047","published":"2023-07-18T20:18:30Z","modified":"2024-09-13T16:21:34Z","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal)","vendor":"Oracle Corporation","product":"PeopleSoft Enterprise PT PeopleTools","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"PeopleSoft Enterprise PT PeopleTools","versions":["8.59","8.60"]}],"description":{"text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.59 and  8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the Portal component of Oracle PeopleSoft Enterprise PeopleTools, affecting supported versions 8.59 and 8.60, lets an attacker compromise the product because a critical function lacks authentication checks. An unauthenticated attacker with network access over HTTP can exploit it with low complexity and no user interaction, gaining unauthorized access to critical data or to all data accessible through PeopleSoft Enterprise PeopleTools.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:02Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.7698,"percentile":0.99548,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - July 2023","url":"https://otx.alienvault.com/pulse/64bace8d5d470a6a7baaa8a9","created":"2023-07-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpujul2023.html","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-26212","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26212","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2025-04-02","earliestUrl":"https://github.com/tuo4n8/CVE-2023-22047","repos":[{"name":"tuo4n8/CVE-2023-22047","url":"https://github.com/tuo4n8/CVE-2023-22047","stars":12,"created":"2025-04-02"},{"name":"0xTerror/CVE-2023-22047---Oracle-PeopleSoft-LFI","url":"https://github.com/0xTerror/CVE-2023-22047---Oracle-PeopleSoft-LFI","stars":1,"created":"2026-08-15"},{"name":"0xTerror/CVE-2023-22047-Oracle-PeopleSoft-LFI","url":"https://github.com/0xTerror/CVE-2023-22047-Oracle-PeopleSoft-LFI","stars":1,"created":"2026-08-15"}]},"nuclei":[{"id":"CVE-2023-22047","name":"Oracle Peoplesoft - Unauthenticated File Read","severity":"high","path":"http/cves/2023/CVE-2023-22047.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22047.yaml"}],"first":{"date":"2025-04-02","source":"PoC-in-GitHub","url":"https://github.com/tuo4n8/CVE-2023-22047"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-07-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-22047","provenance":"source"},{"date":"2025-04-02","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/tuo4n8/CVE-2023-22047","provenance":"source"}],"speed":{"daysToPublicExploit":624,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":30.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9955"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-oracle-peopletools-cwe-306"}}