$ cve CVE-2017-3548 JSON

CVE-2017-3548 EXPLOIT

6.5

MEDIUM · CVSS 3.0 · EPSS 50.8% (pctl 99)

Patch early

A public exploit exists.

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

Scoring

CVSS	6.5 (MEDIUM, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
EPSS	50.84% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-611
On CISA KEV	no
Public exploit	yes
Published	2017-04-24
Last modified	2026-06-17

Affected (1)

Vendor	Product
oracle	peoplesoft enterprise peopletools

Public exploits

Source	Title	Date
exploit-db	Oracle PeopleSoft Enterprise PeopleTools < 8.55 - Remote Code Execution Via Blind XML External Entity	2017-05-17
exploit-db	Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE	2017-04-25

References

→ the Explorer · watch your stack · NVD