WaratekVRT Sign in

CVE-2017-3546 Oracle PeopleSoft Enterprise PeopleTools

Affected softwareOracle PeopleSoft Enterprise PeopleTools
Affected versions8.54, 8.55
Severity6.5 Medium CVSS 3.0 2 scores
Fixed inOracle Critical Patch Update April 2017
WeaknessServer-side request forgery (CWE-918)
Published24 Apr 2017
Updated13 Nov 2026

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2017-05-19.
  • EPSS 9.6% chance in 30 days
IndexArtifactStarsFirst seen
Exploit-DB Oracle PeopleSoft - Server-Side Request Forgery 2017-05-19

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Improper Input Validation Security Rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Improper Input Validation Security Rule

How to mitigate CVE-2017-3546

Apply the fix in Oracle Critical Patch Update April 2017. Until you can, Waratek RASP blocks exploitation with its improper input validation rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

6.5 MEDIUM v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 6.5 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N NVD Primary published
CVSS 2.0 6.4 none AV:N/AC:L/Au:N/C:P/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2017 ↗ CPU 2017-Q2 Oracle PeopleSoft Products / MultiChannel Framework (8.54, 8.55)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle PeopleSoft Products MultiChannel Framework 8.54, 8.55 8.54 · 8.55

Products and versions

1 product, 2 version entries
SourceVendorProductSchemeAffected versions
nvd oracle peoplesoft enterprise peopletools generic 8.54 · 8.55

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/97872 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038301 Third Party Advisory, VDB Entry
https://erpscan.io/advisories/erpscan-17-022-ssrf-peoplesoft-imservlet/ Third Party Advisory
https://www.exploit-db.com/exploits/42034/ Third Party Advisory, VDB Entry

Timeline
Published2017-04-24By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.