CVE-2025-61884

7.5

HIGH CVSS 3.1

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability - [Actively Exploited]

Description

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

INFO

Published Date :

Oct. 12, 2025, 3:15 a.m.

Last Modified :

Oct. 27, 2025, 5:08 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Nov 10, 2025 | 8 days left

Alert Date: Oct 20, 2025 | 12 days ago

Description :

Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://www.oracle.com/security-alerts/alert-cve-2025-61884.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61884

Affected Products

The following products are affected by CVE-2025-61884 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Oracle	configurator

: Total Affected Vendor : 1 | Products : 1

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]

Solution

Patch Oracle Configurator to fix a vulnerability affecting E-Business Suite.

Apply the appropriate patch for Oracle Configurator.
Consult Oracle Security Alert for patch details.

Public PoC/Exploit Available at Github

CVE-2025-61884 has a 9 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-61884.

URL	Resource
https://www.oracle.com/security-alerts/alert-cve-2025-61884.html	Vendor Advisory
https://blogs.oracle.com/security/post/apply-july-2025-cpu	Vendor Advisory
https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/	Exploit Press/Media Coverage
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-61884 is associated with the following CWEs:

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-287: Improper Authentication

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE-501: Trust Boundary Violation

CWE-918: Server-Side Request Forgery (SSRF)

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-61884 weaknesses.

CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic Using Slashes and URL Encoding Combined to Bypass Validation Logic CAPEC-76: Manipulating Web Input to File System Calls Manipulating Web Input to File System Calls CAPEC-78: Using Escaped Slashes in Alternate Encoding Using Escaped Slashes in Alternate Encoding CAPEC-79: Using Slashes in Alternate Encoding Using Slashes in Alternate Encoding CAPEC-126: Path Traversal Path Traversal CAPEC-15: Command Delimiters Command Delimiters CAPEC-81: Web Server Logs Tampering Web Server Logs Tampering CAPEC-22: Exploiting Trust in Client Exploiting Trust in Client CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-94: Adversary in the Middle (AiTM) Adversary in the Middle (AiTM) CAPEC-114: Authentication Abuse Authentication Abuse CAPEC-115: Authentication Bypass Authentication Bypass CAPEC-151: Identity Spoofing Identity Spoofing CAPEC-194: Fake the Source of Data Fake the Source of Data CAPEC-593: Session Hijacking Session Hijacking CAPEC-633: Token Impersonation Token Impersonation CAPEC-650: Upload a Web Shell to a Web Server Upload a Web Shell to a Web Server CAPEC-33: HTTP Request Smuggling HTTP Request Smuggling CAPEC-273: HTTP Response Smuggling HTTP Response Smuggling CAPEC-664: Server Side Request Forgery Server Side Request Forgery

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

AshrafZaryouh/CVE-2025-61884-At-a-Glance

🚨 CVE-2025-61884 — High-Risk Oracle EBS Configurator Info Disclosure

Updated: 5 days, 3 hours ago

0 stars 0 fork 0 watcher

Born at : Oct. 27, 2025, 3:53 p.m. This repo has been linked 1 different CVEs too.

shinyhunt/CVE-2025-61884

None

Updated: 5 days, 14 hours ago

2 stars 0 fork 0 watcher

Born at : Oct. 26, 2025, 12:19 p.m. This repo has been linked 1 different CVEs too.

pakagronglb/oracle-security-breaches-analysis-case-study

A Comprehensive Case Study Analysis of Enterprise Vulnerabilities and Defensive Evolution

case-study cloud cve cybersecurity oracle reporting zero-trust cve-2025-61884

Updated: 1 week, 2 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 23, 2025, noon This repo has been linked 2 different CVEs too.

shinyhunterz/CVE-2025-61884-61882

None

Updated: 1 week, 6 days ago

4 stars 0 fork 0 watcher

Born at : Oct. 19, 2025, 3:23 a.m. This repo has been linked 1 different CVEs too.

B1ack4sh/Blackash-CVE-2025-61884

CVE-2025-61884

Updated: 2 weeks, 5 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 13, 2025, 10:04 a.m. This repo has been linked 1 different CVEs too.

rxerium/CVE-2025-61882-CVE-2025-61884

Detection for CVE-2025-61882

detection nuclei oracle zero-day

Updated: 1 week, 6 days ago

29 stars 8 fork 8 watcher

Born at : Oct. 5, 2025, 6:35 p.m. This repo has been linked 2 different CVEs too.

siddu7575/CVE-2025-61882-CVE-2025-61884

🔍 Detect vulnerabilities CVE-2025-61882 and CVE-2025-61884 in Oracle E-Business Suite to help secure your systems from potential remote code execution threats.

detection nuclei zero-day

Updated: 2 days, 22 hours ago

1 stars 0 fork 0 watcher

Born at : March 4, 2025, 3:38 p.m. This repo has been linked 2 different CVEs too.

DevGreick/devgreick

None

Python

Updated: 1 week ago

1 stars 0 fork 0 watcher

Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 10 different CVEs too.

rxerium/stars

A list of all of my starred repos, automated using Github Actions 🌟

github-actions stars

Updated: 16 hours, 59 minutes ago

0 stars 0 fork 0 watcher

Born at : Jan. 4, 2023, 11:20 a.m. This repo has been linked 30 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-61884 vulnerability anywhere in the article.

The Cyber Express

Hundreds of Australian Devices Compromised with BadCandy Implant

Australian cyber agency has issued a critical advisory warning that over 150 devices in Australia remain compromised with the BadCandy implant as of late October 2025—two years after patches became av ...

Published Date: Oct 31, 2025 (1 day, 9 hours ago)

The Cyber Express

Apache Warns of Critical Tomcat Vulnerabilities Impacting Versions 9, 10, and 11

The Apache Software Foundation has disclosed two new security vulnerabilities affecting multiple versions of Apache Tomcat, warning system administrators to take immediate action. The flaws, identifie ...

Published Date: Oct 29, 2025 (3 days, 11 hours ago)

The Cyber Express

CISA Warns that DELMIA Apriso Vulnerabilities Are Under Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two DELMIA Apriso vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Today’s addition of CVE-2025-6204 and ...

Published Date: Oct 28, 2025 (3 days, 22 hours ago)

The Cyber Express

Critical Flaw CVE-2025-55315 Exposes QNAP NetBak PC Agent to Security Bypass Attacks

A critical vulnerability, tracked as CVE-2025-55315, has been identified in QNAP’s NetBak PC Agent, stemming from a flaw within Microsoft’s ASP.NET Core framework. The issue allows attackers to exploi ...

Published Date: Oct 28, 2025 (4 days, 7 hours ago)

The Cyber Express

New BIND 9 Security Flaw (CVE-2025-40778) Threatens Global DNS Infrastructure

A newly disclosed security flaw has put more than 706,000 BIND 9 DNS resolvers worldwide at risk of cache poisoning attacks, according to an advisory published by the Internet Systems Consortium (ISC) ...

Published Date: Oct 27, 2025 (5 days, 7 hours ago)

The Cyber Express

Microsoft Issues Emergency Patch for Critical WSUS Remote Code Execution Flaw (CVE-2025-59287)

Microsoft has released an urgent out-of-band security update to address a severe remote code execution (RCE) vulnerability in Windows Server Update Services (WSUS). The flaw, tracked as CVE-2025-59287 ...

Published Date: Oct 24, 2025 (1 week, 1 day ago)

The Cyber Express

SessionReaper Exploits Erupt as Magento Sites Lag on Patching

Six weeks after Adobe shipped an emergency fix, attackers have begun weaponizing SessionReaper — and most Magento stores still stand exposed. Security firm Sansec’s forensics team said it blocked hund ...

Published Date: Oct 24, 2025 (1 week, 1 day ago)

The Cyber Express

RCE Vulnerability (CVE-2025-62518) Discovered in Popular Rust Library async-tar and Its Forks

A critical flaw has been identified in a Rust library that demands immediate attention from developers and IT decision-makers leveraging the Rust ecosystem. The vulnerability, tracked as CVE‑2025‑6251 ...

Published Date: Oct 23, 2025 (1 week, 2 days ago)

The Cyber Express

Ransomware Attacks Escalate in APAC Targeting VPN Flaws, Microsoft 365 Logins, Python Scripts

The Asia-Pacific (APAC) region is seeing a rapid surge in number of cyberattacks aimed at its enterprises’, a new report suggests. According to Barracuda’s SOC Threat Radar report, threat actors are i ...

Published Date: Oct 22, 2025 (1 week, 3 days ago)

BleepingComputer

CISA confirms hackers exploited Oracle E-Business Suite SSRF flaw

CISA has confirmed that an Oracle E-Business Suite flaw tracked as CVE-2025-61884 is being exploited in attacks, adding it to its Known Exploited Vulnerabilities catalog. BleepingComputer previously r ...