CVE-2017-10106

🗓️ 08 Aug 2017 15:00:00Reported by oracleType

cve🔗 web.nvd.nist.gov👁 68 Views🌐 WEB

Vulnerability in PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products, affecting versions 8.54 and 8.55, allowing unauthorized access and potential data manipulation. CVSS 3.0 Base Score 6.1

Reporter	Title	Published	Views	Family All 11
0day.today	Oracle PeopleSoft ToolsRelease 8.55.03 / ToolsReleaseDB 8.55 / HCM 9.2 XSS Vulnerabilities	22 Jul 201700:00	–	zdt
CNVD	Oracle PeopleSoft Enterprise PeopleTools Remote Vulnerability (CNVD-2017-21153)	10 Aug 201700:00	–	cnvd
Cvelist	CVE-2017-10106	8 Aug 201715:00	–	cvelist
erpscan	Multiple XSS Vulnerabilities in TestServlet (PeopleSoft)	26 Jan 201700:00	–	erpscan
EUVD	EUVD-2017-1753	7 Oct 202500:30	–	euvd
NVD	CVE-2017-10106	8 Aug 201715:29	–	nvd
Oracle	Oracle Critical Patch Update Advisory - July 2017	20 Mar 201800:00	–	oracle
OSV	CVE-2017-10106	8 Aug 201715:29	–	osv
Packet Storm	PeopleSoft ToolsRelease 8.55.03 / ToolsReleaseDB 8.55 / HCM 9.2 XSS	21 Jul 201700:00	–	packetstorm
Prion	Code injection	8 Aug 201715:29	–	prion

NVD

Vulners

Node

oracle peoplesoft_enterprise_peopletoolsMatch8.54

oracle peoplesoft_enterprise_peopletoolsMatch8.55

[
  {
    "product": "PeopleSoft Enterprise PT PeopleTools",
    "vendor": "Oracle Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "8.54"
      },
      {
        "status": "affected",
        "version": "8.55"
      }
    ]
  }
]

Source	Link
securitytracker	www.securitytracker.com/id/1038932
erpscan	www.erpscan.io/advisories/erpscan-17-037-multiple-xss-vulnerabilities-testservlet-peoplesoft/
oracle	www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
securityfocus	www.securityfocus.com/bid/99777

Parameter	Position	Path	Description	CWE
userID	query param	/pspc/test	XSS via TestServlet (PeopleSoft) PoC using crafted query parameters in POST to /pspc/test	CWE-79
password	query param	/pspc/test	XSS via TestServlet (PeopleSoft) PoC using crafted query parameters in POST to /pspc/test	CWE-79
languageCode	query param	/pspc/test	XSS via TestServlet (PeopleSoft) PoC using crafted query parameters in POST to /pspc/test	CWE-79
siteName	query param	/pspc/test	XSS via TestServlet (PeopleSoft) PoC using crafted query parameters in POST to /pspc/test	CWE-79
CREFName	query param	/pspc/test	XSS via TestServlet (PeopleSoft) PoC using crafted query parameters in POST to /pspc/test	CWE-79
portalName	query param	/pspc/test	XSS via TestServlet (PeopleSoft) PoC using crafted query parameters in POST to /pspc/test	CWE-79
command	query param	/pspc/test	XSS via TestServlet (PeopleSoft) PoC using crafted query parameters in POST to /pspc/test	CWE-79

17 Jun 2026 00:59Current

5.2Medium risk

Vulners AI Score5.2

CVSS 25.8

CVSS 36.1

EPSS0.0166

SSVC