Listen to this Post
How the CVE Works
CVE-2025-50067 is a critical vulnerability in Oracle Application Express (APEX) affecting versions 24.2.4 and 24.2.5. The flaw resides in the Strategic Planner Starter App component, allowing a low-privileged attacker with network access via HTTP to exploit it. The attack requires human interaction (UI:R), meaning the victim must perform an action, such as clicking a malicious link. Due to scope change (S:C), successful exploitation can impact other products beyond APEX. The attacker gains full control (C:H/I:H/A:H) over the system, leading to data theft, manipulation, or service disruption. The CVSS 3.1 score of 9.0 highlights its severity.
DailyCVE Form
Platform: Oracle APEX
Version: 24.2.4, 24.2.5
Vulnerability: Strategic Planner App
Severity: Critical
Date: 07/24/2025
Prediction: Patch by 08/15/2025
What Undercode Say
Analytics:
SELECT FROM apex_applications WHERE version IN ('24.2.4', '24.2.5');
curl -X GET http://<target>/apex/strategic_planner
How Exploit
- Craft malicious HTTP request
- Social engineering (phishing)
- Session hijacking
Protection from this CVE
- Apply Oracle patches
- Disable Strategic Planner App
- Restrict network access
Impact:
- Full system compromise
- Data exfiltration
- Service disruption
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
