CVE-2023-22047

HIGH NUCLEI

Oracle PeopleSoft Enterprise PeopleTools 8.59/8.60 - Unauthenticated Critical Function Access

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-22047. PoCs published by tuo4n8. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository provides a detailed writeup on exploiting CVE-2023-22047, an unauthenticated file read vulnerability in Oracle PeopleSoft, which can be escalated to RCE via SSRF and WebLogic RESTful Management Services. It includes steps for file reading and RCE but lacks actual exploit code.

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Exploits (1)

nomisec WRITEUP 10 stars
by tuo4n8 · poc
https://github.com/tuo4n8/CVE-2023-22047

The repository provides a detailed writeup on exploiting CVE-2023-22047, an unauthenticated file read vulnerability in Oracle PeopleSoft, which can be escalated to RCE via SSRF and WebLogic RESTful Management Services. It includes steps for file reading and RCE but lacks actual exploit code.

Classification
Writeup 90%
Attack Type
Info Leak | Ssrf | Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle PeopleSoft (Portal.war, WSRP Consumer ResourceProxy)
No auth needed
Prerequisites: Access to the target PeopleSoft instance · WebLogic RESTful Management Services enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Oracle Peoplesoft - Unauthenticated File Read
HIGHVERIFIEDby tuo4n8
Shodan: http.title:"oracle peoplesoft enterprise"
FOFA: title="oracle peoplesoft enterprise"

References (1)

Core 1
Core References
Patch, Vendor Advisory vendor-advisory
https://www.oracle.com/security-alerts/cpujul2023.html

Scores

CVSS v3 7.5
EPSS 0.7447
EPSS Percentile 99.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (2)
oracle/peoplesoft_enterprise 8.59
oracle/peoplesoft_enterprise 8.60
Published Jul 18, 2023
Tracked Since Feb 18, 2026