CVE-2010-3526

Vulnerability

An unspecified vulnerability exists in the PeopleSoft Enterprise SCM - PO (Purchasing) component of the Oracle PeopleSoft and JDEdwards Suite. This affects versions 8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6. The exact nature of the bug and the required conditions are not disclosed in the available references, but the Oracle Critical Patch Update Advisory - October 2010 addresses the issue as part of a larger security update [1].

Exploitation

Exploitation requires remote authenticated access to the affected PeopleSoft system. The attacker must have valid user credentials. The precise attack vector or sequence of steps is not detailed in the publicly available references; the vendor advisory classifies the vectors as unknown [1].

Impact

Successful exploitation of this vulnerability can compromise the confidentiality and integrity of the affected system. The attacker does not gain availability impact according to the CVSS specification, and the level of privilege escalation or scope of data access is not further specified in the available documentation [1].

Mitigation

Oracle released the Critical Patch Update for October 2010, which includes a fix for this vulnerability. Users are advised to apply the appropriate patches from Oracle for their affected PeopleSoft Enterprise SCM - PO versions (8.9 Bundle #38, 9.0 Bundle #31, and 9.1 Bundle #6). No workarounds have been provided in the available references [1]. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.