CVE-2023-22047
Published: 18 July 2023
Summary
CVE-2023-22047 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Oracle Peoplesoft Enterprise. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2023-22047 resides in the Portal component of Oracle PeopleSoft Enterprise PeopleTools versions 8.59 and 8.60. It is an easily exploitable flaw that can be reached over HTTP without authentication.
An unauthenticated network attacker can leverage the issue to obtain unauthorized access to critical data or full access to all PeopleSoft Enterprise PeopleTools accessible data, resulting in a high confidentiality impact reflected in the CVSS 3.1 score of 7.5.
The Oracle Critical Patch Update for July 2023 addresses the vulnerability, and administrators are advised to apply the patches referenced in the advisory at https://www.oracle.com/security-alerts/cpujul2023.html.
The associated EPSS score has remained near its peak of 0.9163 with a current value of 0.9072.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-26212
Vulnerability details
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of…
more
this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.
Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.