CVE-2024-21178: Oracle PeopleSoft PeopleTools XSS Vulnerability

CVE-2024-21178 Overview

CVE-2024-21178 is a cross-site scripting (XSS) vulnerability in the Portal component of Oracle PeopleSoft Enterprise PeopleTools. The flaw affects supported versions 8.59, 8.60, and 8.61. An unauthenticated attacker with network access via HTTP can exploit this issue when a targeted user interacts with a crafted request. Successful exploitation causes a scope change, extending impact beyond PeopleTools to other integrated products. Attackers can achieve unauthorized read access to a subset of accessible data and unauthorized insert, update, or delete access to some data. Oracle addressed the vulnerability in the July 2024 Critical Patch Update.

Critical Impact
Unauthenticated attackers can inject script content that executes in the browser context of authenticated PeopleSoft users, enabling data tampering and cross-application impact through the Portal.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.59
Oracle PeopleSoft Enterprise PeopleTools 8.60
Oracle PeopleSoft Enterprise PeopleTools 8.61

Discovery Timeline

2024-07-16 - Oracle releases the July 2024 Critical Patch Update addressing the vulnerability
2024-07-16 - CVE-2024-21178 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21178

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw [CWE-79] in the Portal component of PeopleSoft Enterprise PeopleTools. The Portal aggregates content from multiple PeopleSoft applications, which explains the scope change noted by Oracle. Injected script executes in the authenticated user's browser session and can act against any product surfaced through the Portal.

Exploitation requires user interaction, typically a victim clicking a crafted link or visiting an attacker-controlled page that submits data to the Portal. No credentials are required from the attacker, and network access over HTTP is sufficient. The EPSS probability is 0.268% as of 2026-09-15, indicating low observed exploitation likelihood.

Root Cause

The root cause is insufficient output encoding or input sanitization in a Portal request-handling path. User-controllable input is reflected or stored and rendered in HTML or JavaScript context without adequate neutralization of special characters. Oracle has not published detailed technical analysis of the affected parameter.

Attack Vector

An attacker crafts a URL or form submission containing malicious script directed at a vulnerable Portal endpoint. The attacker delivers the link through phishing, forum posts, or third-party sites. When an authenticated PeopleSoft user follows the link, the Portal renders the payload and the script runs under the origin of the PeopleSoft deployment. The attacker can then perform actions as the victim, read session-accessible data, and pivot across applications reachable through the Portal.

No public proof-of-concept code has been published. Refer to the Oracle Critical Patch Update July 2024 for vendor guidance.

Detection Methods for CVE-2024-21178

Indicators of Compromise

Web server or WAF logs showing HTTP requests to PeopleSoft Portal endpoints containing script tags, javascript: URIs, onerror=, onload=, or encoded variants such as %3Cscript%3E.
Unusual outbound requests from user browsers to attacker-controlled domains immediately after PeopleSoft Portal sessions.
Unexpected data modifications in PeopleSoft records correlated with active user sessions that followed external links.

Detection Strategies

Deploy Content Security Policy (CSP) violation reporting to identify inline script execution attempts within the Portal.
Inspect referrer headers and URL parameters on Portal traffic for HTML and JavaScript metacharacters that survived encoding.
Correlate authentication events with subsequent privileged data operations to surface session-riding behavior.

Monitoring Recommendations

Enable verbose HTTP logging on PeopleSoft web tier and forward to a centralized analytics platform for query and retention.
Alert on anomalous parameter lengths and non-ASCII payloads targeting Portal servlets and iScripts.
Track user-agent, source IP, and session-token reuse patterns to detect potential session theft after XSS execution.

How to Mitigate CVE-2024-21178

Immediate Actions Required

Apply the July 2024 Oracle Critical Patch Update to PeopleTools 8.59, 8.60, and 8.61 environments.
Inventory all Portal-facing PeopleSoft deployments, including non-production tenants used for testing, and confirm patch coverage.
Educate PeopleSoft users to avoid clicking untrusted links that reference internal PeopleSoft hostnames.

Patch Information

Oracle addressed CVE-2024-21178 in the July 2024 Critical Patch Update. Administrators should review the Oracle Critical Patch Update July 2024 advisory and apply the corresponding PeopleTools patch for their version. No workaround is a substitute for the official fix.

Workarounds

Configure a web application firewall rule set that blocks or sanitizes requests containing script tags and event-handler attributes targeting Portal URLs.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict Portal access to trusted networks or VPN-connected users where business requirements allow.

bash

# Example CSP header for the PeopleSoft web tier (adjust to environment)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'"