CVE-2025-61761CWE-284broken-access-control

CVE-2025-61761

Medium · published October 22, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Maintenance Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Maintenance Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Maintenance Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00180 · 7.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-10-22T00:20Z
Affected products (1)
ProductVersionsFixed in
oracle/peoplesoft_enterprise_fin_maintenance_managementall versions—
References (1)
EPSS history
Timeline
  • 21 OCT 20:03Z
    Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management)
    cvelistv5