SB2022072056 - Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
Published: July 20, 2022 Updated: April 12, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2022-21512)
The vulnerability allows a local privileged user to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Integration Broker component in PeopleSoft Enterprise PeopleTools. A local privileged user can exploit this vulnerability to gain access to sensitive information.
2) Improper input validation (CVE-ID: CVE-2022-21521)
The vulnerability allows a remote privileged user to gain access to sensitive information.
The vulnerability exists due to improper input validation within the XML Publisher component in PeopleSoft Enterprise PeopleTools. A remote privileged user can exploit this vulnerability to gain access to sensitive information.
3) Cross-site scripting (CVE-ID: CVE-2021-41182)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of values passed as the `altField` option of the Datepicker widget. A remote attacker can inject and execute arbitrary JavaScript code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Cross-site scripting (CVE-ID: CVE-2020-7656)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within the load() function. A remote attacker can pass specially crafted HTML code to the application and execute it in browser in security context of the affected website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
PoC:
index.html:
<html>
<head>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.js"></script>
</head>
<body>
<div id="mydiv"></div>
<script>
$("#mydiv").load('inject.html #himom');
</script>
</body>
</html>inject.html:
<div id="himom"><script>alert('Arbitrary Code Execution');</script ></div>5) Improper input validation (CVE-ID: CVE-2022-21520)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Fluid Core component in PeopleSoft Enterprise PeopleTools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
6) Infinite loop (CVE-ID: CVE-2022-23437)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when parsing XML documents. A remote attacker can supply a specially crafted XML document, consume all available system resources and cause denial of service conditions.
7) Improper input validation (CVE-ID: CVE-2021-31684)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within indexOf() function of JSONParserByteArray. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
8) Incorrect Regular Expression (CVE-ID: CVE-2022-24729)
The vulnerability allows a remote attacker to perform regular expression denial of service attack.
The vulnerability exists due to improper input validation in CKEditor 4 dialog plugin. A remote attacker can pass specially crafted input to the application and perform regular expression denial of service (ReDoS) attack.
9) Buffer overflow (CVE-ID: CVE-2018-25032)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when compressing data. A remote attacker can pass specially crafted input to the application, trigger memory corruption and perform a denial of service (DoS) attack.
10) Out-of-bounds write (CVE-ID: CVE-2020-36518)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can trigger out-of-bounds write and cause a denial of service condition on the target system.
11) Improper input validation (CVE-ID: CVE-2022-21543)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Updates Environment Mgmt component in PeopleSoft Enterprise PeopleTools. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
Remediation
Install update from vendor's website.