csaf_ncscnl - ncsc-2025-0133

ncsc-2025-0133

Vulnerability from csaf_ncscnl

Published

2025-04-16 15:13

Modified

2025-04-16 15:13

Summary

Kwetsbaarheden verholpen in Oracle PeopleSoft

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Oracle heeft kwetsbaarheden verholpen in Oracle PeopleSoft's Enterprise PeopleTools (versies 8.60, 8.61 en 8.62), Talent Acquisition Manager (versie 9.2) en Enterprise CC Common Application Objects (versie 9.2).

Interpretaties

De kwetsbaarheden in Oracle PeopleSoft's Enterprise PeopleTools, Talent Acquisition Manager en Enterprise CC Common Application Objects stellen laaggeprivilegieerde kwaadwillenden in staat om ongeautoriseerde toegang te verkrijgen en gevoelige gegevens te wijzigen. Ongeauthenticeerde kwaadwillenden kunnen een andere kwetsbaarheid misbruiken om volledige DoS te veroorzaken.

Oplossingen

Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-20

Improper Input Validation

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Oracle heeft kwetsbaarheden verholpen in Oracle PeopleSoft\u0027s Enterprise PeopleTools (versies 8.60, 8.61 en 8.62), Talent Acquisition Manager (versie 9.2) en Enterprise CC Common Application Objects (versie 9.2).",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden in Oracle PeopleSoft\u0027s Enterprise PeopleTools, Talent Acquisition Manager en Enterprise CC Common Application Objects stellen laaggeprivilegieerde kwaadwillenden in staat om ongeautoriseerde toegang te verkrijgen en gevoelige gegevens te wijzigen. Ongeauthenticeerde kwaadwillenden kunnen een andere kwetsbaarheid misbruiken om volledige DoS te veroorzaken.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; nvd; oracle",
        "url": "https://www.oracle.com/security-alerts/cpuapr2025.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Oracle PeopleSoft",
    "tracking": {
      "current_release_date": "2025-04-16T15:13:33.586832Z",
      "generator": {
        "date": "2025-02-25T15:15:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.0"
        }
      },
      "id": "NCSC-2025-0133",
      "initial_release_date": "2025-04-16T15:13:33.586832Z",
      "revision_history": [
        {
          "date": "2025-04-16T15:13:33.586832Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/8.6",
                "product": {
                  "name": "vers:unknown/8.6",
                  "product_id": "CSAFPID-1844416",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:peoplesoft:8.60"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/8.61",
                "product": {
                  "name": "vers:unknown/8.61",
                  "product_id": "CSAFPID-1844415",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:peoplesoft:8.61"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/8.62",
                "product": {
                  "name": "vers:unknown/8.62",
                  "product_id": "CSAFPID-2726967",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:peoplesoft:8.62"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/9.2",
                "product": {
                  "name": "vers:unknown/9.2",
                  "product_id": "CSAFPID-1844417",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:oracle:peoplesoft:9.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft"
          },
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:oracle/9.2",
                    "product": {
                      "name": "vers:oracle/9.2",
                      "product_id": "CSAFPID-1840087",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "PeopleSoft Enterprise CC Common Application Objects"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:oracle/9.2",
                    "product": {
                      "name": "vers:oracle/9.2",
                      "product_id": "CSAFPID-2699168",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_talent_acquisition_manager:9.2:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "PeopleSoft Enterprise HCM Talent Acquisition Manager"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:oracle/8.60",
                    "product": {
                      "name": "vers:oracle/8.60",
                      "product_id": "CSAFPID-1839846",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version_range",
                    "name": "vers:oracle/8.61",
                    "product": {
                      "name": "vers:oracle/8.61",
                      "product_id": "CSAFPID-1839845",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version_range",
                    "name": "vers:oracle/8.62",
                    "product": {
                      "name": "vers:oracle/8.62",
                      "product_id": "CSAFPID-2698962",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "PeopleSoft Enterprise PeopleTools"
              }
            ],
            "category": "product_family",
            "name": "Oracle PeopleSoft"
          },
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:unknown/8.60",
                    "product": {
                      "name": "vers:unknown/8.60",
                      "product_id": "CSAFPID-1211190"
                    }
                  },
                  {
                    "category": "product_version_range",
                    "name": "vers:unknown/8.61",
                    "product": {
                      "name": "vers:unknown/8.61",
                      "product_id": "CSAFPID-1211862"
                    }
                  },
                  {
                    "category": "product_version_range",
                    "name": "vers:unknown/8.62",
                    "product": {
                      "name": "vers:unknown/8.62",
                      "product_id": "CSAFPID-2698378"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Peoplesoft Enterprise Peopletools"
              }
            ],
            "category": "product_family",
            "name": "Oracle"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/8.60",
                "product": {
                  "name": "vers:unknown/8.60",
                  "product_id": "CSAFPID-2115767"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/8.61",
                "product": {
                  "name": "vers:unknown/8.61",
                  "product_id": "CSAFPID-2136023"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:unknown/8.62",
                "product": {
                  "name": "vers:unknown/8.62",
                  "product_id": "CSAFPID-2726823"
                }
              }
            ],
            "category": "product_name",
            "name": "peoplesoft_enterprise_peopletools"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:semver/9.2",
                "product": {
                  "name": "vers:semver/9.2",
                  "product_id": "CSAFPID-2698650"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise CC Common Application Objects"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:semver/9.2",
                "product": {
                  "name": "vers:semver/9.2",
                  "product_id": "CSAFPID-2698644"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise HCM Talent Acquisition Manager"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:semver/8.60",
                "product": {
                  "name": "vers:semver/8.60",
                  "product_id": "CSAFPID-2698490"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/8.61",
                "product": {
                  "name": "vers:semver/8.61",
                  "product_id": "CSAFPID-2698491"
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/8.62",
                "product": {
                  "name": "vers:semver/8.62",
                  "product_id": "CSAFPID-2698492"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise PeopleTools"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-52428",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        },
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "other",
          "text": "Improper Input Validation",
          "title": "CWE-20"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1844416",
          "CSAFPID-1844415",
          "CSAFPID-2726967",
          "CSAFPID-1844417",
          "CSAFPID-1840087",
          "CSAFPID-2699168",
          "CSAFPID-1839846",
          "CSAFPID-1839845",
          "CSAFPID-2698962",
          "CSAFPID-1211190",
          "CSAFPID-1211862",
          "CSAFPID-2698378",
          "CSAFPID-2115767",
          "CSAFPID-2136023",
          "CSAFPID-2726823",
          "CSAFPID-2698650",
          "CSAFPID-2698644",
          "CSAFPID-2698490",
          "CSAFPID-2698491",
          "CSAFPID-2698492"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-52428",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-52428.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1844416",
            "CSAFPID-1844415",
            "CSAFPID-2726967",
            "CSAFPID-1844417",
            "CSAFPID-1840087",
            "CSAFPID-2699168",
            "CSAFPID-1839846",
            "CSAFPID-1839845",
            "CSAFPID-2698962",
            "CSAFPID-1211190",
            "CSAFPID-1211862",
            "CSAFPID-2698378",
            "CSAFPID-2115767",
            "CSAFPID-2136023",
            "CSAFPID-2726823",
            "CSAFPID-2698650",
            "CSAFPID-2698644",
            "CSAFPID-2698490",
            "CSAFPID-2698491",
            "CSAFPID-2698492"
          ]
        }
      ],
      "title": "CVE-2023-52428"
    },
    {
      "cve": "CVE-2025-30697",
      "product_status": {
        "known_affected": [
          "CSAFPID-1844416",
          "CSAFPID-1844415",
          "CSAFPID-2726967",
          "CSAFPID-1844417",
          "CSAFPID-1840087",
          "CSAFPID-2699168",
          "CSAFPID-1839846",
          "CSAFPID-1839845",
          "CSAFPID-2698962",
          "CSAFPID-1211190",
          "CSAFPID-1211862",
          "CSAFPID-2698378",
          "CSAFPID-2115767",
          "CSAFPID-2136023",
          "CSAFPID-2726823",
          "CSAFPID-2698650",
          "CSAFPID-2698644",
          "CSAFPID-2698490",
          "CSAFPID-2698491",
          "CSAFPID-2698492"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-30697",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30697.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1844416",
            "CSAFPID-1844415",
            "CSAFPID-2726967",
            "CSAFPID-1844417",
            "CSAFPID-1840087",
            "CSAFPID-2699168",
            "CSAFPID-1839846",
            "CSAFPID-1839845",
            "CSAFPID-2698962",
            "CSAFPID-1211190",
            "CSAFPID-1211862",
            "CSAFPID-2698378",
            "CSAFPID-2115767",
            "CSAFPID-2136023",
            "CSAFPID-2726823",
            "CSAFPID-2698650",
            "CSAFPID-2698644",
            "CSAFPID-2698490",
            "CSAFPID-2698491",
            "CSAFPID-2698492"
          ]
        }
      ],
      "title": "CVE-2025-30697"
    },
    {
      "cve": "CVE-2025-30713",
      "product_status": {
        "known_affected": [
          "CSAFPID-1844416",
          "CSAFPID-1844415",
          "CSAFPID-2726967",
          "CSAFPID-1844417",
          "CSAFPID-1840087",
          "CSAFPID-2699168",
          "CSAFPID-1839846",
          "CSAFPID-1839845",
          "CSAFPID-2698962",
          "CSAFPID-1211190",
          "CSAFPID-1211862",
          "CSAFPID-2698378",
          "CSAFPID-2115767",
          "CSAFPID-2136023",
          "CSAFPID-2726823",
          "CSAFPID-2698650",
          "CSAFPID-2698644",
          "CSAFPID-2698490",
          "CSAFPID-2698491",
          "CSAFPID-2698492"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-30713",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30713.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1844416",
            "CSAFPID-1844415",
            "CSAFPID-2726967",
            "CSAFPID-1844417",
            "CSAFPID-1840087",
            "CSAFPID-2699168",
            "CSAFPID-1839846",
            "CSAFPID-1839845",
            "CSAFPID-2698962",
            "CSAFPID-1211190",
            "CSAFPID-1211862",
            "CSAFPID-2698378",
            "CSAFPID-2115767",
            "CSAFPID-2136023",
            "CSAFPID-2726823",
            "CSAFPID-2698650",
            "CSAFPID-2698644",
            "CSAFPID-2698490",
            "CSAFPID-2698491",
            "CSAFPID-2698492"
          ]
        }
      ],
      "title": "CVE-2025-30713"
    },
    {
      "cve": "CVE-2025-30735",
      "product_status": {
        "known_affected": [
          "CSAFPID-1844416",
          "CSAFPID-1844415",
          "CSAFPID-2726967",
          "CSAFPID-1844417",
          "CSAFPID-1840087",
          "CSAFPID-2699168",
          "CSAFPID-1839846",
          "CSAFPID-1839845",
          "CSAFPID-2698962",
          "CSAFPID-1211190",
          "CSAFPID-1211862",
          "CSAFPID-2698378",
          "CSAFPID-2115767",
          "CSAFPID-2136023",
          "CSAFPID-2726823",
          "CSAFPID-2698650",
          "CSAFPID-2698644",
          "CSAFPID-2698490",
          "CSAFPID-2698491",
          "CSAFPID-2698492"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-30735",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30735.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1844416",
            "CSAFPID-1844415",
            "CSAFPID-2726967",
            "CSAFPID-1844417",
            "CSAFPID-1840087",
            "CSAFPID-2699168",
            "CSAFPID-1839846",
            "CSAFPID-1839845",
            "CSAFPID-2698962",
            "CSAFPID-1211190",
            "CSAFPID-1211862",
            "CSAFPID-2698378",
            "CSAFPID-2115767",
            "CSAFPID-2136023",
            "CSAFPID-2726823",
            "CSAFPID-2698650",
            "CSAFPID-2698644",
            "CSAFPID-2698490",
            "CSAFPID-2698491",
            "CSAFPID-2698492"
          ]
        }
      ],
      "title": "CVE-2025-30735"
    }
  ]
}

CVE-2023-52428 (GCVE-0-2023-52428)

Vulnerability from cvelistv5

Published

2024-02-11 00:00

Modified

2024-10-30 19:50

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

Summary

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

References

►

URL

Tags

	https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/
	https://connect2id.com/products/nimbus-jose-jwt
	https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52428",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-30T19:49:39.428104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-30T19:50:55.784Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.674Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://connect2id.com/products/nimbus-jose-jwt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-11T04:43:14.335876",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/"
        },
        {
          "url": "https://connect2id.com/products/nimbus-jose-jwt"
        },
        {
          "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-52428",
    "datePublished": "2024-02-11T00:00:00",
    "dateReserved": "2024-02-11T00:00:00",
    "dateUpdated": "2024-10-30T19:50:55.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30713 (GCVE-0-2025-30713)

Vulnerability from cvelistv5

Published

2025-04-15 20:31

Modified

2025-04-16 15:39

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Talent Acquisition Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Talent Acquisition Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Talent Acquisition Manager accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Talent Acquisition Manager accessible data.

Summary

Vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager product of Oracle PeopleSoft (component: Job Opening). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Talent Acquisition Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Talent Acquisition Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Talent Acquisition Manager accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Talent Acquisition Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

References

►

URL

Tags

https://www.oracle.com/security-alerts/cpuapr2025.html

vendor-advisory

Impacted products

	Vendor	Product	Version
	Oracle Corporation	PeopleSoft Enterprise HCM Talent Acquisition Manager	Version: 9.2 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T14:09:21.357072Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T15:39:59.684Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PeopleSoft Enterprise HCM Talent Acquisition Manager",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "9.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_talent_acquisition_manager:9.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager product of Oracle PeopleSoft (component: Job Opening).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Talent Acquisition Manager.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Talent Acquisition Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Talent Acquisition Manager accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise HCM Talent Acquisition Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Talent Acquisition Manager.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Talent Acquisition Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Talent Acquisition Manager accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise HCM Talent Acquisition Manager accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-15T20:31:11.030Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2025.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2025-30713",
    "datePublished": "2025-04-15T20:31:11.030Z",
    "dateReserved": "2025-03-25T20:11:18.268Z",
    "dateUpdated": "2025-04-16T15:39:59.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30735 (GCVE-0-2025-30735)

Vulnerability from cvelistv5

Published

2025-04-15 20:31

Modified

2025-04-17 03:55

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CC Common Application Objects accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CC Common Application Objects accessible data.

Summary

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page and Field Configuration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CC Common Application Objects accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

References

►

URL

Tags

https://www.oracle.com/security-alerts/cpuapr2025.html

vendor-advisory

Impacted products

	Vendor	Product	Version
	Oracle Corporation	PeopleSoft Enterprise CC Common Application Objects	Version: 9.2 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30735",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-17T03:55:28.453Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PeopleSoft Enterprise CC Common Application Objects",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "9.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page and Field Configuration).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CC Common Application Objects accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CC Common Application Objects accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CC Common Application Objects accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-15T20:31:19.752Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2025.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2025-30735",
    "datePublished": "2025-04-15T20:31:19.752Z",
    "dateReserved": "2025-03-25T20:11:18.276Z",
    "dateUpdated": "2025-04-17T03:55:28.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-30697 (GCVE-0-2025-30697)

Vulnerability from cvelistv5

Published

2025-04-15 20:31

Modified

2025-04-16 20:01

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data.

Summary

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.60, 8.61 and 8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

References

►

URL

Tags

https://www.oracle.com/security-alerts/cpuapr2025.html

vendor-advisory

Impacted products

	Vendor	Product	Version
	Oracle Corporation	PeopleSoft Enterprise PeopleTools	Version: 8.60 ≤ Version: 8.61 ≤ Version: 8.62 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30697",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T20:01:06.989889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T20:01:29.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PeopleSoft Enterprise PeopleTools",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "8.60",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.61",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.62",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor).  Supported versions that are affected are 8.60, 8.61 and  8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-15T20:31:05.371Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2025.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2025-30697",
    "datePublished": "2025-04-15T20:31:05.371Z",
    "dateReserved": "2025-03-25T20:11:18.263Z",
    "dateUpdated": "2025-04-16T20:01:29.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ncsc-2025-0133

Vulnerability from csaf_ncscnl

CVE-2023-52428 (GCVE-0-2023-52428)

Vulnerability from cvelistv5

CVE-2025-30713 (GCVE-0-2025-30713)

Vulnerability from cvelistv5

CVE-2025-30735 (GCVE-0-2025-30735)

Vulnerability from cvelistv5

CVE-2025-30697 (GCVE-0-2025-30697)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature