Vulnerability record · CVE-2017-3548 · published 24 April 2017
CVE-2017-3548: Oracle PeopleSoft PeopleTools Integration Broker XXE flaw
Oracle · Peoplesoft Enterprise Peopletools
CVE-2017-3548 is an XML external entity (XXE) vulnerability in the Integration Broker subcomponent of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.54 and 8.55. An unauthenticated attacker with network access can send crafted XML over HTTP to read a subset of accessible data and cause a partial denial of service.
Description
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Automated analysis
high priorityUnauthenticated network-reachable XXE with public exploit references and a very high EPSS score, though impact is limited to partial confidentiality and availability loss.
What it is
CVE-2017-3548 is an XML external entity (XXE) vulnerability in the Integration Broker subcomponent of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.54 and 8.55. An unauthenticated attacker with network access can send crafted XML over HTTP to read a subset of accessible data and cause a partial denial of service.
Impact
The attacker gains unauthorized read access to a limited subset of PeopleSoft Enterprise PeopleTools data and can degrade availability through a partial denial of service. Integrity is not affected per the CVSS vector.
Attack surface
Reachable over the network via HTTP against the Integration Broker interface, with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV, but EPSS is high at roughly 0.51 (98.9th percentile), and public references include an Exploit-DB entry and an ERPSCAN advisory, indicating public exploit information exists.
What to do
- Apply the April 2017 Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools 8.54 and 8.55.
- Disable external entity and DTD processing in the XML parser used by Integration Broker.
- Restrict network access to Integration Broker HTTP endpoints to trusted sources only.
- Monitor for and block XML payloads containing DOCTYPE or external entity declarations at the perimeter.
Detection
- Inspect HTTP requests to Integration Broker endpoints for DOCTYPE declarations or SYSTEM/PUBLIC external entity references.
- Alert on outbound connections from PeopleSoft servers to unexpected internal or external hosts, which may indicate XXE data exfiltration.
- Review PeopleSoft and web server logs for anomalous XML parsing errors or repeated malformed XML submissions.
- Correlate spikes in Integration Broker request volume with availability degradation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html | PatchVendor Advisory |
| http://www.securityfocus.com/bid/97880 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038301 | Third Party AdvisoryVDB Entry |
| https://erpscan.io/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft/ | Third Party Advisory |
| https://www.exploit-db.com/exploits/41925/ | Third Party AdvisoryVDB Entry |
| http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html | PatchVendor Advisory |
| http://www.securityfocus.com/bid/97880 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038301 | Third Party AdvisoryVDB Entry |
| https://erpscan.io/advisories/erpscan-17-020-xxe-via-doctype-peoplesoft/ | Third Party Advisory |
| https://www.exploit-db.com/exploits/41925/ | Third Party AdvisoryVDB Entry |
Track CVE-2017-3548 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-3548), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
