CVE-2025-61884
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
Description
CVE-2025-61884 is a high-severity vulnerability in the Oracle Configurator product of Oracle E-Business Suite, specifically in the Runtime UI component, affecting supported versions 12.2.3 through 12.2.14. The flaw involves multiple weakness types including path traversal, CRLF injection, improper authentication, HTTP request smuggling, trust boundary violation, and SSRF, enabling an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data. With a CVSS v3.1 base score of 7.5, an EPSS score of 41.6% (97.3rd percentile), and a confirmed ransomware association marked as "Known," this vulnerability requires immediate remediation. CISA has added it to the KEV catalog with a deadline of November 10, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | configurator | >= 12.2.3, <= 12.2.14 |
References
- https://www.oracle.com/security-alerts/alert-cve-2025-61884.html(Vendor Advisory)
- https://blogs.oracle.com/security/post/apply-july-2025-cpu(Vendor Advisory)
- https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/(Exploit, Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884(US Government Resource)
Weakness Type
CWE-22: Path Traversal
CWE-22 describes a vulnerability where software uses external input to construct a pathname to a file or directory without properly neutralizing special characters such as "../" that could resolve to a location outside the restricted directory. In the context of CVE-2025-61884, path traversal allows an attacker to access files outside the intended web root.
CWE-93: CRLF Injection
CWE-93 describes a weakness where software does not properly neutralize CRLF (Carriage Return Line Feed) sequences in input, allowing an attacker to inject malicious headers or split HTTP responses. In this vulnerability, CRLF injection contributes to the overall attack chain against Oracle Configurator.
CWE-287: Improper Authentication
CWE-287 describes a condition where software does not properly verify the identity of an actor before granting access. This weakness enables the unauthenticated exploitation of CVE-2025-61884.
CWE-444: HTTP Request Smuggling
CWE-444 describes a weakness where intermediaries (proxies, firewalls) and back-end servers interpret HTTP requests differently, allowing an attacker to smuggle requests that bypass security controls. This contributes to the attack chain in CVE-2025-61884.
CWE-501: Trust Boundary Violation
CWE-501 describes a weakness where software mixes trusted and untrusted data in the same data structure or communication channel, potentially causing trusted code to process untrusted data without proper validation.
CWE-918: Server-Side Request Forgery (SSRF)
CWE-918 describes a vulnerability where the server can be induced to make requests to an attacker-specified destination, potentially accessing internal services or sensitive resources. SSRF in Oracle Configurator could allow an attacker to reach internal network resources through the vulnerable server.
Impact Analysis
The business impact of CVE-2025-61884 is significant, particularly regarding data confidentiality. Confidentiality impact is high because successful exploitation grants unauthorized access to critical data within the Oracle E-Business Suite environment, which typically contains sensitive financial records, customer data, procurement information, and business-critical configuration details. Integrity and availability are not directly rated as impacted in the CVSS score, but the complex attack chain involving six distinct weakness types suggests the potential for broader exploitation scenarios.
The EPSS score of 41.6% (97.3rd percentile) indicates a very high probability of exploitation, higher than over 97% of all tracked vulnerabilities. Critically, this vulnerability has a known ransomware association, meaning threat actors deploying ransomware have been observed exploiting or targeting this flaw. Oracle E-Business Suite is widely deployed in large enterprises for financial management, supply chain operations, and human resources, making it a high-value target. The combination of unauthenticated remote access, critical data exposure, and confirmed ransomware usage creates an urgent risk profile. Organizations running affected versions face potential regulatory penalties, financial loss from data breaches, and operational disruption from ransomware attacks.
Exploit Maturity
CVE-2025-61884 has confirmed active exploitation and is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 10, 2025. Notably, CISA has marked the ransomware usage as Known, meaning this vulnerability has been observed in ransomware campaigns. The EPSS score of 41.6% (97.3rd percentile) reflects very high exploitation probability. A detailed technical exploit analysis has been published by watchTowr Labs, which describes a pre-authentication remote code execution chain targeting Oracle E-Business Suite that includes this vulnerability. The public availability of exploit research, combined with the confirmed ransomware association, indicates a very high level of exploit maturity and active threat actor interest.
Remediation
- Apply the Oracle Critical Patch Update immediately. Refer to the Oracle Security Alert for CVE-2025-61884 and the July 2025 CPU blog post for detailed patching instructions. Apply all patches applicable to Oracle Configurator versions 12.2.3 through 12.2.14.
- Restrict network access to Oracle E-Business Suite. Place the Oracle E-Business Suite behind a web application firewall and restrict HTTP access to only authorized users and networks. Block direct internet exposure of the Oracle Configurator Runtime UI.
- Deploy WAF rules targeting the identified attack vectors. Configure web application firewall rules to detect and block path traversal sequences, CRLF injection attempts, HTTP request smuggling patterns, and SSRF probes targeting the Oracle Configurator endpoint.
- Audit Oracle E-Business Suite for indicators of compromise. Review application logs, web server access logs, and database audit trails for unusual access patterns to the Configurator Runtime UI, unexpected file access outside normal directories, or signs of data exfiltration.
- Implement network segmentation for the database tier. Ensure the Oracle database backend is not directly accessible from the web tier, limiting the impact of SSRF attacks that could attempt to reach internal database services through the compromised application server.
Technical Details
The CVSS v3.1 base score for CVE-2025-61884 is 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Attack Vector (AV:N) confirms remote exploitation over HTTP. Attack Complexity (AC:L) indicates the attack is straightforward. Privileges Required (PR:N) means no authentication is needed, and User Interaction (UI:N) means no victim action is required. Scope (S:U) is unchanged. Confidentiality (C:H) is rated high, reflecting complete access to critical data, while Integrity (I:N) and Availability (A:N) are not directly impacted according to the base score.
The vulnerability is technically complex, involving six distinct CWE categories that form an attack chain. The Oracle Configurator Runtime UI component processes HTTP requests in a way that is vulnerable to multiple input manipulation techniques. An attacker can leverage path traversal (CWE-22) to access files outside intended directories, CRLF injection (CWE-93) to manipulate HTTP headers and responses, and HTTP request smuggling (CWE-444) to bypass front-end security controls. The improper authentication (CWE-287) allows these attacks without any credentials. Trust boundary violations (CWE-501) enable the attacker to inject untrusted data into trusted processing contexts, and SSRF (CWE-918) allows the attacker to use the server to make requests to internal resources. Together, these weaknesses enable comprehensive unauthorized access to critical data within the Oracle E-Business Suite environment.
Frequently Asked Questions
What is CVE-2025-61884?
CVE-2025-61884 is a high-severity vulnerability in the Oracle Configurator component of Oracle E-Business Suite (versions 12.2.3 through 12.2.14) that allows an unauthenticated attacker to gain unauthorized access to critical data via HTTP. It involves multiple attack vectors including path traversal, CRLF injection, and SSRF.
Is CVE-2025-61884 associated with ransomware?
Yes. CISA has marked the ransomware usage for this vulnerability as "Known," meaning threat actors deploying ransomware have been observed exploiting or targeting this flaw. This makes immediate patching especially critical for organizations running affected Oracle E-Business Suite versions.
What data is at risk from CVE-2025-61884?
Oracle E-Business Suite typically contains highly sensitive business data including financial records, customer information, procurement data, human resources records, and system configuration details. The vulnerability provides unauthorized access to critical data, meaning all of this information could potentially be exposed.
How can I determine if my Oracle E-Business Suite is vulnerable?
If you are running Oracle Configurator versions 12.2.3 through 12.2.14 and have not applied the July 2025 Critical Patch Update, your installation is vulnerable. Check your Oracle E-Business Suite version and review the Oracle Security Alert and CPU documentation for applicable patches.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.