CVE-2023-22047

What it actually does

CVE-2023-22047 is an unauthenticated, network-exploitable information disclosure vulnerability in the Portal component of Oracle PeopleSoft Enterprise PeopleTools versions 8.59 and 8.60. An attacker with HTTP access to the PeopleSoft web interface can trigger the flaw without credentials or user interaction and obtain unauthorized access to critical PeopleTools-accessible data. The stated impact is confidentiality-only: the vulnerability does not directly provide documented integrity modification or denial-of-service capability, but disclosure of sensitive application, identity, HR, finance, workflow, or configuration data may enable follow-on compromise.

Why it matters to the business

Organizations running exposed Oracle PeopleSoft Enterprise PeopleTools 8.59 or 8.60 may face unauthorized disclosure of highly sensitive enterprise data through the web tier. Because PeopleSoft commonly supports HR, finance, payroll, identity, and business workflow functions, exploitation could lead to privacy incidents, regulatory reporting obligations, credential or session exposure, fraud enablement, and loss of trust. The vulnerability is easy to exploit, requires no authentication, has a high EPSS score of 0.7698, and is described as weaponized, so internet-facing or partner-accessible PeopleSoft portals should be treated as high-priority remediation targets even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an Oracle PeopleSoft Enterprise PeopleTools portal reachable over HTTP or HTTPS, commonly by fingerprinting PeopleSoft-specific login pages, headers, paths, or static content. If the instance runs an affected 8.59 or 8.60 PeopleTools release and has not received the relevant Oracle Critical Patch Update, the attacker sends crafted unauthenticated HTTP requests to the Portal component. The vulnerable component improperly exposes data that should require authorization, allowing the attacker to retrieve critical PeopleTools-accessible information without logging in. The attacker may then use the disclosed information to enumerate users, understand application configuration, harvest sensitive business data, or support later attacks such as credential targeting, session abuse, privilege escalation through other weaknesses, or social engineering.

How to fix it

Apply the Oracle Critical Patch Update that fixes CVE-2023-22047 for Oracle PeopleSoft Enterprise PeopleTools 8.59 and 8.60. If exact fixed PeopleTools patch levels are managed through Oracle Support, verify the required PeopleTools patch or PeopleSoft Update Image against the July 2023 Oracle CPU advisory and apply it across all PeopleSoft web, application, and process scheduler tiers as applicable. If immediate patching is not possible, reduce exposure by restricting PeopleSoft Portal access to trusted networks or VPN, enforcing strong reverse-proxy or WAF access controls, disabling unnecessary public access to PeopleSoft endpoints, and increasing logging for unauthenticated Portal requests. Do not rely on network filtering as a permanent fix; upgrade or patch the affected PeopleTools release.

How to confirm the fix worked

Confirm the deployed PeopleTools version and patch level are no longer vulnerable according to Oracle’s July 2023 Critical Patch Update guidance for PeopleSoft Enterprise PeopleTools. Inventory all PeopleSoft instances, including production, disaster recovery, test, staging, internet-facing, partner-facing, and internally exposed portals. Validate that unauthenticated users cannot access sensitive Portal resources or data through direct HTTP requests. Review web server, reverse proxy, load balancer, and PeopleSoft application logs for continued attempts against Portal endpoints after patching. Where available, run an authenticated configuration or vulnerability scan that checks Oracle PeopleSoft Enterprise PeopleTools 8.59/8.60 patch status rather than relying only on banner detection.

Typical attack path

1. Discover PeopleSoft Enterprise web portals exposed to the internet, VPN users, partners, or internal networks.
2. Fingerprint the target to confirm it is Oracle PeopleSoft Enterprise PeopleTools, especially versions 8.59 or 8.60.
3. Send crafted unauthenticated HTTP requests to the PeopleTools Portal component.
4. Retrieve data that should normally require authentication or authorization.
5. Analyze disclosed records, metadata, configuration, or identity-related information for sensitive content.
6. Use the exposed information for data theft, reconnaissance, fraud, credential attacks, or chaining with other PeopleSoft or infrastructure vulnerabilities.

How to detect it

Investigate HTTP access logs from PeopleSoft web servers, Oracle HTTP Server, WebLogic access logs, reverse proxies, WAFs, and load balancers for unauthenticated requests to PeopleSoft Portal-related endpoints, especially from unfamiliar external IP addresses, scanners, cloud hosting providers, or sources generating high request volumes. Focus on requests that returned HTTP 200, 206, or unusually large response sizes without an established PeopleSoft session cookie. Correlate requests lacking valid PeopleSoft authentication cookies with access to Portal, content, node, component, or servlet paths. Review PeopleSoft application logs and WebLogic logs for anomalous Portal servlet activity, authorization errors followed by successful data retrieval, unexpected object or content references, and bursts of enumeration-style parameter changes. Because the public description does not provide a stable exploit string, detection should emphasize behavior: unauthenticated access to sensitive PeopleSoft paths, abnormal response sizes, repeated parameter probing, and access from IPs not associated with normal users or integrations. If exploitation is suspected, preserve web-tier logs, application server logs, WAF events, proxy logs, and relevant session records; assess what data was returned and whether exposed secrets, account information, or regulated data require rotation or notification.

• /psp/
• /psc/
• /EMPLOYEE/
• /HRMS/
• /cs/
• /signon.html
• /ps/signon.html
• /psc/.*?cmd=
• /psp/.*?cmd=
• /psc/.*?contentref=
• /psp/.*?contentref=
• /psc/.*?FolderPath=
• /psp/.*?FolderPath=
• /psc/.*?PortalActualURL=
• /psp/.*?PortalActualURL=
• PS_TOKEN
• PS_TOKENEXPIRE
• PS_LOGINLIST
• PS_DEVICEFEATURES
• SignOnPeopleCode
• PeopleSoft Portal
• PeopleTools

What your security team should do

• Treat exposed PeopleSoft Enterprise PeopleTools 8.59 and 8.60 systems as urgent patch candidates because the issue is unauthenticated, easy to exploit, high-confidence EPSS, and weaponized.
• Identify all PeopleSoft Portal URLs and confirm whether any are reachable from the internet, third-party networks, or broad internal user segments.
• Apply the relevant Oracle Critical Patch Update or PeopleTools patch for CVE-2023-22047 and document the fixed patch level for each environment.
• Temporarily restrict access to PeopleSoft Portal endpoints using VPN, allowlists, reverse proxy policy, or WAF rules until patching is complete.
• Enable and retain detailed HTTP access logs for PeopleSoft web tiers, reverse proxies, and load balancers to support retrospective investigation.
• Hunt for unusual unauthenticated GET or POST activity to PeopleSoft Portal paths, spikes in requests from unknown IPs, and successful HTTP 200 responses to sensitive endpoints without a prior authenticated session.
• Review whether disclosed PeopleSoft data could include credentials, tokens, employee records, payroll data, or configuration secrets, and rotate exposed secrets where disclosure is suspected.
• Monitor Oracle advisories and threat intelligence for proof-of-concept details, mass exploitation activity, or later inclusion in CISA KEV.