Listen to this Post
How the CVE Works:
CVE-2025-50107 is a vulnerability in Oracle Universal Work Queue (UWQ) within Oracle E-Business Suite (versions 12.2.5-12.2.14). The flaw exists in the request handling component, allowing unauthenticated attackers to exploit it via HTTP. The attack requires user interaction (UI:R), meaning the victim must perform an action, such as clicking a malicious link. Successful exploitation leads to unauthorized data modification (insert/update/delete) and partial data exposure. Due to scope change (S:C), the impact may extend beyond UWQ. The CVSS 3.1 score is 6.1 (Medium), reflecting limited confidentiality (C:L) and integrity (I:L) impacts.
DailyCVE Form:
Platform: Oracle E-Business Suite
Version: 12.2.5-12.2.14
Vulnerability: Request Handling
Severity: Medium
Date: 07/24/2025
Prediction: Patch by 08/30/2025
What Undercode Say:
Analytics:
nmap -p 80,443 --script oracle-vuln-cve-2025-50107 <target_IP>
import requests exploit_url = "http://<target>/UWQ/endpoint?malicious_param=payload"
How Exploit:
- Craft malicious HTTP request
- Trick user into triggering request
- Bypass access controls
Protection from this CVE:
- Apply Oracle patch
- Restrict HTTP access
- Educate users
Impact:
- Data leakage
- Unauthorized modifications
- Scope expansion
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
