Listen to this Post
How the CVE Works:
CVE-2025-50105 is an access control vulnerability in Oracle Universal Work Queue (UWQ) within Oracle E-Business Suite (versions 12.2.3-12.2.14). Attackers with low privileges can exploit it via HTTP requests to manipulate critical data without authorization. The flaw arises from improper validation in the Work Provider Administration component, allowing unauthorized users to create, delete, or modify sensitive data. The CVSS 3.1 score of 8.1 reflects high risks to confidentiality and integrity due to the attack’s low complexity and network accessibility.
DailyCVE Form:
Platform: Oracle E-Business Suite
Version: 12.2.3-12.2.14
Vulnerability: Unauthorized Data Access
Severity: Critical
Date: 07/24/2025
Prediction: Patch expected by 08/15/2025
What Undercode Say:
Analytics:
SELECT FROM uwq_admin WHERE version BETWEEN '12.2.3' AND '12.2.14';
curl -X POST -d "malicious_payload" http://target/uwq_admin
How Exploit:
- Craft HTTP requests to Work Provider Administration endpoints.
- Bypass privilege checks via manipulated parameters.
Protection from this CVE:
- Apply Oracle’s upcoming patch.
- Restrict HTTP access to UWQ.
- Enforce role-based access controls.
Impact:
- Unauthorized data modification.
- Full compromise of UWQ data.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
