CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2025-10-12
Oracle E-Business Suite Configurator (Runtime UI) Pre-Auth Information Disclosure & SSRF Vulnerability (CVE-2025-61884)
[Affected Scope] Oracle E-Business Suite versions 12.2.3 through 12.2.14, specifically the Oracle Configurator (Runtime UI) component.
[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to gain unauthorized access to critical data or compromise the entire Oracle Configurator data.
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict external HTTP/HTTPS access to the affected endpoints.