CVE-2021-35606
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In Oracle PeopleSoft Enterprise CS Campus Community (Notification Framework) versions 9.0 and 9.2, a low-privileged attacker with physical access to the communication segment can gain unauthorized access to critical data or all accessible data.
Risk Assessment
An attacker with local physical access can compromise sensitive system data, potentially violating student and staff privacy and system integrity.
Recommendation
Apply the patch provided by Oracle or upgrade to a version beyond 9.0 and 9.2, and restrict physical access to the infrastructure.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Notification Framework). Supported versions that are affected are 9.0 and 9.2. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise CS Campus Community executes to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).