CVE-2017-10338: Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (su...

Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Enterprise Portal). The supported version that is affected is 9.1.00. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

UnknownCVSS not scoredNot KEV-listedUpdatedOct 4, 2024, 16:50 UTC (UTC+00:00)

Analyst readout for executives and security teams

Plain-English summary

This flaw affects Oracle PeopleSoft Enterprise PRTL Interaction Hub 9.1.00. An unauthenticated attacker reaching it over HTTP could, with user interaction, gain access to sensitive portal data and make limited unauthorized data changes. The business concern is data exposure and integrity impact in a portal that may connect to other PeopleSoft functions.

Executive priority

Treat as high priority if PeopleSoft Interaction Hub 9.1.00 exists. The issue can expose critical data and allow some unauthorized data changes without attacker credentials, although known active exploitation is not established in the provided sources.

Technical view

CVE-2017-10338 is an Oracle PeopleSoft Enterprise Portal vulnerability in PRTL Interaction Hub 9.1.00. The CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, scoring 8.2. It is network reachable over HTTP, needs no attacker privileges, requires victim interaction, and has changed scope.

Likely exposure

Exposure is limited to organizations running PeopleSoft Enterprise PRTL Interaction Hub version 9.1.00, especially where the portal is reachable over HTTP from untrusted networks or broad internal user populations.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Oracle describes the issue as easily exploitable over HTTP but requiring interaction from a person other than the attacker.

Researcher notes

Key constraints are UI:R and HTTP network access. Scope is changed, so downstream PeopleSoft or connected product impact should be assessed, but the bundle only names PRTL Interaction Hub 9.1.00 as affected.

Mitigation direction

Check Oracle CPU October 2017 and current Oracle support guidance for the affected product.
Patch or retire PeopleSoft Enterprise PRTL Interaction Hub 9.1.00 if present.
Restrict HTTP access to trusted networks and authenticated access paths.
Review portal-facing controls for phishing-resistant user interaction risk.
Increase monitoring for unusual portal data access or modification activity.

Validation and detection

Inventory PeopleSoft Enterprise PRTL Interaction Hub deployments and confirm exact version.
Verify whether version 9.1.00 remains deployed in production or recovery environments.
Confirm Oracle CPU October 2017 or later applicable fixes were applied.
Map internet, partner, VPN, and internal HTTP reachability to the portal.
Review logs for abnormal portal access and unauthorized data modification indicators.

Prepared: Jun 12, 2026, 20:36 UTC (UTC+00:00)
Confidence: high
Sources: 5

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-10338 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Oct 19, 2017, 17:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
1039598CVE reference · vdb-entry, x_refsource_SECTRACK
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlCVE reference · x_refsource_CONFIRM
101464CVE reference · vdb-entry, x_refsource_BID

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

Oracle CorporationPeopleSoft Enterprise PRTL Interaction Hub9.1.00Listed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.