CVE-2011-2272

Vulnerability

This vulnerability exists in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products, specifically within the eProcurement module. The affected versions are PeopleSoft Enterprise FSCM 9.0 Bundle #36 and 9.1 Bundle #13 [1]. The vulnerability is unspecified but is known to be exploitable by remote authenticated users via unknown vectors related to eProcurement [1].

Exploitation

An attacker must have valid credentials to authenticate to the PeopleSoft system [1]. The exploitation does not require any special network position beyond authenticated access to the application. The specific attack vector is not disclosed in the available references, but it involves unknown vectors related to eProcurement functionality [1].

Impact

Successful exploitation allows a remote authenticated user to compromise both the confidentiality and integrity of the affected system [1]. The attacker can potentially access sensitive information and modify data within the PeopleSoft FSCM environment. The specific scope and privilege level of the compromise are not detailed in the available references.

Mitigation

Oracle released a Critical Patch Update (CPU) in July 2011 to address this vulnerability [1]. The fix is included in Bundle #37 for PeopleSoft Enterprise FSCM 9.0 and Bundle #14 for version 9.1. Organizations should apply the appropriate CPU patch as provided by Oracle. No workarounds are documented in the references.