CVE-2025-61884: high-severity vulnerability in Oracle Configurator
Published · Updated
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 7.5epss 96%
from disclosure to weapon1 days
Published on NVDOct 12
1st PoC+1d
CISA KEV+8d
exploitation probability
96%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2025-11-10
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
In short
A flaw in Oracle Configurator (part of E-Business Suite versions 12.2.3-12.2.14) allows attackers to access sensitive data without authentication over the network. An attacker can exploit this through a simple HTTP request to read confidential information.
Technical detail
Path traversal, authentication bypass, and HTTP request smuggling weaknesses in the Runtime UI component enable unauthenticated remote attackers to access restricted data. The vulnerability requires only network access and no user interaction; successful exploitation results in high confidentiality impact with unauthorized access to critical Configurator data.
Summary generated and translated by AI from the official description.
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).