CVE-2025-61884

Published Oct 12, 2025

Last updated a day ago

Oracle Configurator

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-61884 is a vulnerability affecting the Oracle Configurator component's Runtime UI within the Oracle E-Business Suite (EBS). The vulnerability impacts versions 12.2.3 through 12.2.14. It can be exploited by an unauthenticated attacker with network access via HTTP. Successful exploitation of CVE-2025-61884 can lead to unauthorized access to critical data or complete access to all Oracle Configurator accessible data. Oracle has released a security patch to address this vulnerability and strongly recommends that customers apply the provided updates promptly.

Description: Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Source: secalert_us@oracle.com
NVD status: Modified
Products: configurator

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
Exploit added on: Oct 20, 2025
Exploit action due: Nov 10, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-22

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 21

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:configurator:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5CC0EA09-3974-4A14-8724-27020AECB5A8",
            "versionEndIncluding": "12.2.14",
            "versionStartIncluding": "12.2.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.