cve-2026-60615

{
  "cve": "CVE-2026-60615",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "9.2.38"
            }
          }
        ],
        "enrichment": {
          "confidence": 95.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 95.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "PeopleSoft Enterprise CS Campus Community",
          "source": "cna",
          "vendor": "Oracle Corporation"
        },
        "product": "peoplesoft_enterprise_cs_campus_community",
        "vendor": "oracle"
      }
    ],
    "created": "2026-07-23T03:30:05.392506+00:00",
    "updated": "2026-08-04T17:15:03.002402+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$peoplesoft_enterprise_cs_campus_community"
    ]
  },
  "epss": {
    "score": 0.00353
  },
  "mitre": {
    "cpes": [
      "cpe:2.3:a:oracle:peoplesoft_enterprise_cs_campus_community:9.2.38:*:*:*:*:*:*:*"
    ],
    "created": "2026-07-21T21:36:10.022000+00:00",
    "description": "Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security).   The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.2,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/60xxx/CVE-2026-60615.json",
    "references": [
      "https://www.oracle.com/security-alerts/cpujul2026.html"
    ],
    "title": null,
    "updated": "2026-07-27T16:41:32.799000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$peoplesoft_enterprise_cs_campus_community"
    ],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:oracle:peoplesoft_enterprise_campus_software_campus_community:9.2.38:*:*:*:*:*:*:*"
    ],
    "created": "2026-07-21T22:18:01.910000+00:00",
    "description": "Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security).   The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.2,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-60615.json",
    "references": [
      "https://www.oracle.com/security-alerts/cpujul2026.html"
    ],
    "title": null,
    "updated": "2026-07-31T19:55:48.633000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$peoplesoft_enterprise_campus_software_campus_community"
    ],
    "weaknesses": [
      "CWE-287"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-07-21T22:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security).   The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).",
              "old": null
            },
            "type": "description"
          },
          {
            "details": [
              "oracle",
              "oracle$PRODUCT$peoplesoft_enterprise_cs_campus_community"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:oracle:peoplesoft_enterprise_cs_campus_community:9.2.38:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "oracle",
                "oracle$PRODUCT$peoplesoft_enterprise_cs_campus_community"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://www.oracle.com/security-alerts/cpujul2026.html"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 8.2,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "f67ede51-06bc-4471-bdaf-f487cfe31ec4"
      },
      {
        "created": "2026-07-23T23:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "Untrusted HTTP Remote Access Vulnerability in Oracle PeopleSoft Campus Community",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-284"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "c0da4703-159c-4ace-9af1-e65c6a60f3ca"
      },
      {
        "created": "2026-07-27T17:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "CWE-287"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "none",
                    "Technical Impact": "partial"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "b8cdb8fa-0587-4eaa-a99a-ea664f88745d"
      },
      {
        "created": "2026-07-30T14:00:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Untrusted HTTP Remote Access Vulnerability in Oracle PeopleSoft Campus Community"
            },
            "type": "title"
          },
          {
            "details": {
              "added": [],
              "removed": [
                "CWE-284"
              ]
            },
            "type": "weaknesses"
          }
        ],
        "id": "af706a9b-389d-476f-abe0-defaa9e19441"
      },
      {
        "created": "2026-08-01T05:45:00+00:00",
        "data": [
          {
            "details": {
              "new": "Improper Access Control Exposing Sensitive Data via HTTP in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38",
              "old": null
            },
            "type": "title"
          }
        ],
        "id": "a0805bb3-8447-437a-bd34-31021c6594a5"
      },
      {
        "created": "2026-08-04T17:30:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Improper Access Control Exposing Sensitive Data via HTTP in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38"
            },
            "type": "title"
          }
        ],
        "id": "3f56a597-e99b-4a85-a792-8db72b43c670"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:oracle:peoplesoft_enterprise_campus_software_campus_community:9.2.38:*:*:*:*:*:*:*",
        "cpe:2.3:a:oracle:peoplesoft_enterprise_cs_campus_community:9.2.38:*:*:*:*:*:*:*"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "created": {
      "data": "2026-07-21T21:36:10.022000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security).   The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 8.2,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00353
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "yes",
            "Exploitation": "none",
            "Technical Impact": "partial"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://www.oracle.com/security-alerts/cpujul2026.html"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": null,
      "provider": null
    },
    "updated": {
      "data": "2026-08-04T17:15:03.002402+00:00",
      "provider": "enrichment"
    },
    "vendors": {
      "data": [
        "oracle",
        "oracle$PRODUCT$peoplesoft_enterprise_campus_software_campus_community",
        "oracle$PRODUCT$peoplesoft_enterprise_cs_campus_community"
      ],
      "providers": [
        "mitre",
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-287"
      ],
      "providers": [
        "nvd",
        "vulnrichment"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-07-21T21:36:10.022000+00:00",
    "description": "Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security).   The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "yes",
          "Exploitation": "none",
          "Technical Impact": "partial"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": null,
    "updated": "2026-07-27T16:41:28.462000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/60xxx/CVE-2026-60615.json",
    "weaknesses": [
      "CWE-287"
    ]
  }
}