CVE-2025-21562: Oracle PeopleSoft Information Disclosure

CVE-2025-21562 Overview

CVE-2025-21562 is an authorization vulnerability in the Oracle PeopleSoft Enterprise CC Common Application Objects product, specifically within the Run Control Management component. The flaw affects supported version 9.2 and allows a low-privileged attacker with network access over HTTP to read a subset of application data without authorization. Oracle disclosed the issue in its January 2025 Critical Patch Update. The vulnerability is classified under [CWE-863: Incorrect Authorization] and impacts confidentiality only, with no direct integrity or availability effect.

Critical Impact
An authenticated attacker with minimal privileges can obtain unauthorized read access to data managed by PeopleSoft Enterprise CC Common Application Objects.

Affected Products

Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2
Run Control Management component
Deployments exposing PeopleSoft HTTP interfaces to authenticated users

Discovery Timeline

2025-01-21 - CVE-2025-21562 published to the National Vulnerability Database (NVD)
2025-01-21 - Oracle released fixes as part of the January 2025 Critical Patch Update
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-21562

Vulnerability Analysis

The vulnerability resides in the Run Control Management component of Oracle PeopleSoft Enterprise CC Common Application Objects 9.2. Run Control Management governs how batch and reporting processes are parameterized and executed by PeopleSoft users. An attacker holding a valid low-privilege account can send crafted HTTP requests that bypass expected authorization checks and return data that should be restricted. The exposure is limited to confidentiality; the flaw does not permit data modification or service disruption. Because PeopleSoft applications often store financial, HR, and campus solutions records, even a partial read primitive can meaningfully expand an attacker's access to sensitive business data.

Root Cause

Oracle's advisory attributes the issue to improper authorization logic in Run Control Management, consistent with [CWE-863]. Access decisions do not correctly restrict which run control records or related objects a low-privilege session can view. Authenticated users can therefore reach data that the application's role model was meant to segregate.

Attack Vector

Exploitation requires network reachability to the PeopleSoft web tier and a valid user account with low privileges. No user interaction is required, and Oracle rates the attack complexity as low. The attacker interacts with the exposed HTTP endpoints of the Run Control Management functionality to trigger the authorization gap and retrieve unauthorized data. Oracle has not reported public exploitation, and no proof-of-concept code is currently listed in Exploit-DB or the CISA Known Exploited Vulnerabilities catalog.

No verified public exploit code is available for CVE-2025-21562. Refer to the Oracle Critical Patch Update Advisory - January 2025 for authoritative fix details.

Detection Methods for CVE-2025-21562

Indicators of Compromise

Anomalous HTTP requests from low-privileged accounts targeting Run Control Management pages or component interfaces.
Unusual volume of successful record reads by service accounts or standard users outside of their normal business scope.
Access to run control records by users who have never previously interacted with those business processes.

Detection Strategies

Enable and review PeopleSoft application server and web server access logs for requests to Run Control Management URLs by non-administrative users.
Correlate authenticated session activity with role assignments to identify data reads that exceed the user's PeopleSoft permission list.
Baseline normal Run Control Management usage per role and alert on statistical deviations.

Monitoring Recommendations

Forward PeopleSoft PIA, application server, and database audit logs to a centralized analytics platform for retention and correlation.
Monitor for enumeration patterns such as sequential run control ID access or repeated failed-then-successful authorization attempts.
Track privileged operations and any lateral movement from PeopleSoft user accounts into adjacent systems.

How to Mitigate CVE-2025-21562

Immediate Actions Required

Apply the January 2025 Oracle Critical Patch Update fixes for PeopleSoft Enterprise CC Common Application Objects 9.2 as soon as change windows allow.
Inventory all PeopleSoft 9.2 environments, including non-production instances, to confirm patch coverage.
Review PeopleSoft user roles and permission lists to enforce least privilege for Run Control Management access.

Patch Information

Oracle addressed CVE-2025-21562 in the January 2025 Critical Patch Update. Administrators should follow the guidance in the Oracle Critical Patch Update Advisory - January 2025 to identify the applicable PeopleTools and application patches for their deployment. Oracle recommends applying Critical Patch Update fixes without delay, as unpatched Oracle products are regularly targeted by opportunistic and targeted attackers.

Workarounds

Restrict network access to PeopleSoft web interfaces using VPN, allow-listing, or reverse-proxy authentication where feasible.
Disable or restrict user accounts that do not require Run Control Management functionality until patches are deployed.
Increase logging verbosity on the PeopleSoft web and application tiers to improve detection coverage while remediation is in progress.

bash

# Example: restrict access to PeopleSoft PIA to trusted networks at the reverse proxy
# nginx snippet - adjust to match your environment
location /psp/ {
    allow 10.10.0.0/16;   # corporate range
    allow 10.20.0.0/16;   # VPN range
    deny  all;
    proxy_pass http://peoplesoft_backend;
}