Listen to this Post
How the CVE Works
CVE-2025-30747 is an unauthenticated vulnerability in Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology) affecting versions 8.60, 8.61, and 8.62. The flaw allows remote attackers to access sensitive data via HTTP without authentication. Exploitation requires social engineering to trick a user into interacting with a malicious link. The vulnerability stems from improper access control in the PIA Core component, enabling unauthorized read operations. Attackers craft a specially crafted HTTP request, which, when triggered by a victim, bypasses authorization checks. The CVSS 3.1 score of 4.3 reflects limited confidentiality impact (C:L) due to partial data exposure.
DailyCVE Form
Platform: Oracle PeopleSoft
Version: 8.60, 8.61, 8.62
Vulnerability: Unauthenticated Data Access
Severity: Medium
Date: 07/25/2025
Prediction: Patch by 08/30/2025
What Undercode Say
Analytics:
nmap -p 80 --script http-vuln-cve2025-30747 <target> curl -X GET "http://<target>/psp/exploit_path"
How Exploit:
- Craft malicious HTTP request.
- Social engineering to trigger interaction.
- Harvest exposed data.
Protection from this CVE:
- Apply Oracle patch.
- Restrict HTTP access.
- User awareness training.
Impact:
- Unauthorized data leakage.
- Partial confidentiality breach.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
