CVE-2024-21283: Oracle PeopleSoft Auth Bypass Vulnerability

CVE-2024-21283 Overview

CVE-2024-21283 is an authorization vulnerability in the Oracle PeopleSoft Enterprise HCM Global Payroll Core product, within the Global Payroll for Core component. Supported versions 9.2.48 through 9.2.50 are affected. An authenticated attacker with low privileges and network access via HTTP can compromise the application. Successful exploitation permits unauthorized creation, modification, or deletion of critical payroll data, along with full read access to all data accessible to the Global Payroll Core module. Oracle addressed this issue in the October 2024 Critical Patch Update. The weakness is categorized under CWE-863: Incorrect Authorization.

Critical Impact
Low-privileged authenticated users can gain unauthorized read and write access to sensitive payroll and human capital management data over the network.

Affected Products

Oracle PeopleSoft Enterprise HCM Global Payroll Core 9.2.48
Oracle PeopleSoft Enterprise HCM Global Payroll Core 9.2.49
Oracle PeopleSoft Enterprise HCM Global Payroll Core 9.2.50

Discovery Timeline

2024-10-15 - CVE-2024-21283 published to NVD alongside the Oracle October 2024 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21283

Vulnerability Analysis

The flaw resides in the Global Payroll for Core component of PeopleSoft Enterprise HCM. It is classified as an incorrect authorization weakness [CWE-863], meaning the application does not correctly enforce access controls on protected operations. An authenticated attacker can reach the vulnerable HTTP endpoint using an account that holds only low-privileged roles. Once reached, the endpoint fails to validate whether the calling user is authorized to read or modify the requested payroll records.

Successful exploitation grants attackers unauthorized access to confidential payroll data, including compensation, deductions, tax information, and other personally identifiable information. It also allows insertion, modification, or deletion of records within the Global Payroll Core dataset. Availability of the service is not impacted, but the integrity of financial and HR data is.

Root Cause

The underlying cause is missing or improperly implemented server-side authorization checks in the Global Payroll for Core module. The application appears to trust the client-supplied context or role assignment without verifying whether the authenticated principal has the specific entitlement required for the requested data operation. This is a classic broken access control pattern in enterprise HCM applications.

Attack Vector

Exploitation requires network access to the PeopleSoft web tier over HTTP and any valid low-privileged PeopleSoft account. No user interaction is required. The attacker sends crafted HTTP requests to Global Payroll Core endpoints and receives data or performs write operations that the account should not be entitled to. Oracle has not published exploitation details, and no public proof-of-concept is currently available.

A verified exploitation code sample is not available. Consult the Oracle Critical Patch Update Advisory - October 2024 for authoritative remediation guidance.

Detection Methods for CVE-2024-21283

Indicators of Compromise

Unexpected read or write activity from low-privileged PeopleSoft user accounts against Global Payroll Core pages, components, or web services.
Anomalous PeopleSoft audit log entries showing record inserts, updates, or deletes on payroll tables by users outside the payroll administration role.
HTTP traffic to Global Payroll Core URLs from user sessions that historically only access self-service HCM functions.

Detection Strategies

Enable and review PeopleSoft database-level auditing (PSAUDIT) on Global Payroll Core tables to identify record changes attributable to non-payroll roles.
Correlate PeopleSoft web server access logs with role assignments to flag low-privileged users invoking payroll components.
Baseline normal payroll workflow activity and alert on deviations such as off-hours modifications or bulk record access.

Monitoring Recommendations

Forward PeopleSoft application, web server, and database audit logs to a centralized SIEM or data lake for correlation and long-term retention.
Monitor Oracle database sessions originating from the PeopleSoft application server for unexpected DML statements against Global Payroll schemas.
Track privileged role assignments and grants inside PeopleSoft Security Administrator to detect unauthorized elevation.

How to Mitigate CVE-2024-21283

Immediate Actions Required

Apply the fixes delivered in the Oracle Critical Patch Update - October 2024 to all PeopleSoft HCM 9.2.48-9.2.50 environments.
Inventory PeopleSoft user accounts and remove unnecessary access to Global Payroll Core components and web services.
Review recent PeopleSoft audit and database logs for signs of unauthorized data access or modification prior to patching.

Patch Information

Oracle released the fix for CVE-2024-21283 as part of the October 2024 Critical Patch Update. Administrators must apply the corresponding PeopleSoft HCM Global Payroll patch bundle to eliminate the vulnerability. Refer to the Oracle Critical Patch Update Advisory - October 2024 for downloads, prerequisites, and version-specific instructions.

Workarounds

Restrict network exposure of PeopleSoft web tier hosts to trusted corporate networks and VPN segments until patching is complete.
Tighten PeopleSoft permission lists and roles so that only payroll administrators can access Global Payroll Core components.
Enforce strong authentication and session controls on all PeopleSoft accounts to reduce the pool of low-privileged accounts available to an attacker.

bash

# Configuration example: identify PeopleSoft users with access to Global Payroll Core
# Run inside the PeopleSoft database as a read-only auditor account.
SELECT R.ROLEUSER, RC.CLASSID
  FROM PSROLEUSER R
  JOIN PSROLECLASS RC ON R.ROLENAME = RC.ROLENAME
 WHERE RC.CLASSID IN (
     SELECT CLASSID FROM PSAUTHITEM
      WHERE MENUNAME LIKE 'GP_%' OR MENUNAME LIKE '%PAYROLL%'
 )
 ORDER BY R.ROLEUSER;