Oracle Configurator - Authentication Bypass (CVE-2025-61884)
Description
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
psychologyCrowdSec Analysis
CVE-2025-61884 is a vulnerability in Oracle Configurator within Oracle E-Business Suite (versions 12.2.3 to 12.2.14) that allows unauthenticated attackers with network access to compromise the system via HTTP. Exploiting this flaw could grant unauthorized access to sensitive or critical data managed by Oracle Configurator, posing a significant confidentiality risk.
CrowdSec has been tracking this vulnerability and its exploits since 5th of November 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-61884 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2025-61884 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Attackers exploit this vulnerability by sending crafted POST requests to the /OA_HTML/configurator/UiServlet endpoint, embedding external URLs in the return_url parameter to trigger server-side request forgery (SSRF) in Oracle E-Business Suite.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-10-12 |
| CISA KEV | 2025-10-20 |
| Rule Released | 2025-11-05 |
| CrowdSec First Seen | 2025-11-05 |
| CISA Remediation Deadline | 2025-11-10 |
Related Weaknesses
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
The product mixes trusted and untrusted data in the same data structure or structured message.
Remediation & Protection
External References
- https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884
- https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61884.yaml