CVE-2025-61884

Analyzed
Published: 12 Oct 2025, 02:34
Last modified:21 Oct 2025, 22:45

Vulnerability Summary

Overall Risk (default)
medium
48/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
41.64% HIGH
42% probability -2.44%
KEV
Listed
CISA
1 listing
Ransomware
Known Use
Public exploits
1 found
Dark Web
Not detected

Timeline

12 Oct 2025, 02:34
Published
Vulnerability first disclosed
20 Oct 2025, 00:00
Added to CISA KEV
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
21 Oct 2025, 22:45
Last Modified
Vulnerability information updated
10 Nov 2025, 00:00
CISA Remediation Due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 41.64%• Percentile: 97%

Techniques & Countermeasures

  • CWE-918•Server-Side Request Forgery (SSRF)

    The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

  • CWE-22•Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  • CWE-93•Improper Neutralization of CRLF Sequences ('CRLF Injection')

    The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

  • CWE-444•Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

    The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

  • CWE-287•Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  • CWE-501•Trust Boundary Violation

    The product mixes trusted and untrusted data in the same data structure or structured message.

Affected Systems

  • oracle corporation•oracle configurator

    ≥ 12.2.3, ≤ 12.2.14

  • oracle•configurator

    ≥ 12.2.3, ≤ 12.2.14

References (4)