CVE-2018-2654 is an easily exploitable vulnerability in the PeopleSoft Enterprise HCM Human Resources component (specifically the Company Dir / Org Chart Viewer) of Oracle PeopleSoft Products, version 9.2. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require user interaction and can lead to unauthorized modification or deletion of some data, as well as unauthorized read access to a subset of data within PeopleSoft Enterprise HCM Human Resources. The vulnerability has a CVSS 3.0 Base Score of 6.1 (Medium), indicating moderate severity with low confidentiality and integrity impacts. The attack vector is network-based, requires user interaction, and has low attack complexity. While the vulnerability is within PeopleSoft HCM Human Resources, successful attacks may significantly impact additional products. There is no evidence of active exploitation, nor is there any publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for the vast majority of reported vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
9.2CPE matchmatch criteria | cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_human_resources:9.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.