CVE-2025-61882

Warnung

Medienbericht

Exploit

EPSS 99.72%
Veröffentlicht 05.10.2025 03:17:01
Zuletzt bearbeitet 27.10.2025 17:08:52
Quelle secalert_us@oracle.com
CVE-Watchlists
Login
Unerledigt
Login

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Betroffene Produkte Warnungen 2 Metriken 2 CWE 1 Referenzen 16

NVD 1 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Oracle ≫ Concurrent Processing Version >= 12.2.3 <= 12.2.14

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

07.10.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

Oracle E-Business Suite Unspecified Vulnerability

Schwachstelle

Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen

06.10.2025:

https://www.cert.at/de/warnungen/2025/10/schwerwiegende-sicherheitslucke-in-oracle-e-business-suite-aktiv-ausgenutzt-updates-verfugbar

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	99.72%	1

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
secalert_us@oracle.com	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.