This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Oracle E-Business Suite fixes a critical vulnerability
Oracle is fixing a critical vulnerability in Oracle E-Business Suite. To fix the vulnerability, it is necessary to make sure that the October 2023 critical patch has been applied and then update to the latest version [1].
An unauthenticated remote attacker can use a specially crafted HTTP request to carry out an SSRF attack, which leads to the download of a malicious XML file that allows execution of arbitrary JavaScript code and thus enables the creation of a reverse shell [1][2]. The vulnerability is being actively exploited [2][3]. Further details and IoCs can be found at [2]. As a temporary fix, it is possible to disable the extension for executing JavaScript code within XML files and to restrict outbound requests from the affected machine [2].
The vulnerability is present in product:
- Oracle E-Business Suite; >=12.2.3, <=12.2.14;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-61882 at cve.org, NVD
- CWE-611: Improper Restriction of XML External Entity Reference at cwe.mitre.org
- CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 4. 10. 2025.
Links
- [1] https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
- [2] https://www.resecurity.com/blog/article/cve-2025-61882-mass-exploitation-oracle-e-business-suite-ebs-under-attack-by-cl0p-ransomware
- [3] https://www.ncsc.gov.uk/news/active-exploitation-vulnerability-affecting-oracle-ebusiness-suite
By CESNET, z.s.p.o. Martin Krajči on 9. 10. 2025.