HIGH

CVE-2025-61884

Oracle Configurator 2025-10-12 CVSS v3.1

CVSS

7.5

KEV

Description

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Summary dbcve.org

An unauthenticated HTTP-based vulnerability in the Runtime UI component of Oracle Configurator (versions 12.2.3-12.2.14) allows remote attackers to access sensitive data without credentials. The CVSS vector indicates a network-level attack with low complexity, no privileges required, and high confidentiality impact.

Mitigation

Apply the relevant Oracle Critical Patch Update (CPU) for this vulnerability to all affected Oracle Configurator installations. Restrict network access to the Runtime UI component where possible until patching can be completed.

Proof of Concept