CVE-2025-61882

🗓️ 05 Oct 2025 03:17:01Reported by oracleType

cve🔗 web.nvd.nist.gov📰️ 93 Media mentions👁 663 Views🌐 WEB

CVE-2025-61882 is a security vulnerability.

Reporter	Title	Published	Views	Family All 50
GithubExploit	Exploit for Improper Authentication in Oracle Concurrent_Processing	23 Oct 202507:57	–	githubexploit
GithubExploit	Exploit for CVE-2025-61882	5 Oct 202518:35	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Oracle Concurrent_Processing	6 Oct 202522:02	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Oracle Concurrent_Processing	6 Oct 202520:56	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Oracle Concurrent_Processing	10 Feb 202600:33	–	githubexploit
GithubExploit	Exploit for CRLF Injection in Oracle Concurrent_Processing	16 Oct 202515:33	–	githubexploit
GithubExploit	Exploit for CRLF Injection in Oracle Concurrent_Processing	10 Oct 202518:28	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Oracle Concurrent_Processing	5 Oct 202518:35	–	githubexploit
GithubExploit	Exploit for CRLF Injection in Oracle Concurrent_Processing	16 Oct 202505:15	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Oracle Concurrent_Processing	21 Nov 202520:05	–	githubexploit

NVD

Vulners

CNA

Node

oracle concurrent_processingRange12.2.3–12.2.14

[
  {
    "vendor": "Oracle Corporation",
    "product": "Oracle Concurrent Processing",
    "versions": [
      {
        "version": "12.2.3",
        "status": "affected",
        "lessThanOrEqual": "12.2.14",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/security-alerts/alert-cve-2025-61882.html
blogs	www.blogs.oracle.com/security/post/apply-july-2025-cpu
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
crowdstrike	www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/

Parameter	Position	Path	Description	CWE
redirectFromJsp	request body	/OA_HTML/configurator/UiServlet	UiServlet used to smuggle requests for desynchronization and CSRF token usage.	CWE-287
getUiType	request body	/OA_HTML/configurator/UiServlet	UiServlet used to smuggle requests for desynchronization and CSRF token usage.	CWE-287
oa_csrf_token	request body	/OA_HTML/configurator/UiServlet	UiServlet used to smuggle requests for desynchronization and CSRF token usage.	CWE-287
CSRF-XHR	request body	/OA_HTML/JavaScriptServlet	Endpoint used to retrieve CSRF token (CSRF token fetch flow).	CWE-287
FETCH-CSRF-TOKEN	request body	/OA_HTML/JavaScriptServlet	Endpoint used to retrieve CSRF token (CSRF token fetch flow).	CWE-287
X-Requested-With	request body	/OA_HTML/JavaScriptServlet	Endpoint used to retrieve CSRF token (CSRF token fetch flow).	CWE-287

27 Oct 2025 17:08Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.19.8

EPSS0.90862

SSVC

CVE-2025-61882