Listen to this Post
How the CVE Works
CVE-2025-50108 is a Cross-Site Request Forgery (CSRF) vulnerability in Oracle Hyperion Financial Reporting (component: Workspace) version 11.2.20.0.000. An attacker can exploit this flaw by tricking an authenticated user into executing unintended actions via crafted HTTP requests. Due to insufficient CSRF protections, a low-privileged attacker with network access can manipulate financial data or extract sensitive information. The attack requires user interaction (UI:R) but can affect other connected systems (scope change). The CVSS 3.1 score reflects moderate confidentiality (C:L) and integrity (I:L) impacts.
DailyCVE Form
Platform: Oracle Hyperion
Version: 11.2.20.0.000
Vulnerability: CSRF
Severity: Medium
Date: 07/24/2025
Prediction: Patch by 09/2025
What Undercode Say
Analytics:
nmap -p 80 --script http-csrf <target> curl -X POST -d "malicious_payload" <victim_endpoint>
How Exploit:
- Craft malicious HTML form
- Phish authenticated user
- Submit forged HTTP request
Protection from this CVE:
- Implement CSRF tokens
- Use SameSite cookies
- Update to patched version
Impact:
- Unauthorized data modification
- Partial data leakage
- Chained attacks
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
