Oracle E-Business Suite (October 2025 CPU)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271365);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id(
    "CVE-2025-53041",
    "CVE-2025-53043",
    "CVE-2025-53052",
    "CVE-2025-53058",
    "CVE-2025-53064",
    "CVE-2025-53071",
    "CVE-2025-53072",
    "CVE-2025-61753",
    "CVE-2025-62481"
  );
  script_xref(name:"IAVA", value:"2025-A-0797-S");

  script_name(english:"Oracle E-Business Suite (October 2025 CPU)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as
referenced in the October 2025 CPU advisory.

  - Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing
    Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability
    allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful
    attacks of this vulnerability can result in takeover of Oracle Marketing. (CVE-2025-53072, CVE-2025-62481)

  - Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).
    Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low
    privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of
    this vulnerability can result in unauthorized creation, deletion or modification access to critical data
    or all Oracle Product Hub accessible data as well as unauthorized access to critical data or complete
    access to all Oracle Product Hub accessible data. (CVE-2025-53043)

  - Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous).
    Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows
    unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks
    require human interaction from a person other than the attacker and while the vulnerability is in Oracle
    Scripting, attacks may significantly impact additional products (scope change). Successful attacks of this
    vulnerability can result in unauthorized update, insert or delete access to some of Oracle Scripting
    accessible data as well as unauthorized read access to a subset of Oracle Scripting accessible data.
    (CVE-2025-61753)

  - Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component:
    Application Logging Interfaces). Supported versions that are affected are 12.2.3-12.2.14. Easily
    exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise
    Oracle Applications Manager. Successful attacks require human interaction from a person other than the
    attacker and while the vulnerability is in Oracle Applications Manager, attacks may significantly impact
    additional products (scope change). Successful attacks of this vulnerability can result in unauthorized
    update, insert or delete access to some of Oracle Applications Manager accessible data as well as
    unauthorized read access to a subset of Oracle Applications Manager accessible data. (CVE-2025-53058)

  - Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification
    Mailer). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows
    unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks
    require human interaction from a person other than the attacker and while the vulnerability is in Oracle
    Workflow, attacks may significantly impact additional products (scope change). Successful attacks of this
    vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow
    accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data.
    (CVE-2025-53052)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/docs/tech/security-alerts/cpuoct2025csaf.json");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuoct2025.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the October 2025 Oracle Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-53072");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/24");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:e-business_suite");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_e-business_query_patch_info.nbin");
  script_require_keys("Oracle/E-Business/Version", "Oracle/E-Business/patches/installed");

  exit(0);
}

include('vcf_extras_oracle.inc');

var app_info = vcf::oracle_ebusiness::get_app_info();

var constraints = [
  { 'min_version': '12.2.3',  'max_version': '12.2.3.999999',  'fix_patches': '38298685, 37450688, 38510732'},
  { 'min_version': '12.2.4',  'max_version': '12.2.4.999999',  'fix_patches': '38298685, 38261373, 37450688, 38510732'},
  { 'min_version': '12.2.5',  'max_version': '12.2.5.999999',  'fix_patches': '38298685, 36589745, 38261383, 37450688, 38180394, 38510732'},
  { 'min_version': '12.2.6',  'max_version': '12.2.6.999999',  'fix_patches': '38298685, 36589745, 38261530, 37450688, 38180394, 38510732'},
  { 'min_version': '12.2.7',  'max_version': '12.2.7.999999',  'fix_patches': '38298685, 36589745, 38261387, 37450688, 38180394, 38510732'},
  { 'min_version': '12.2.8',  'max_version': '12.2.8.999999',  'fix_patches': '38298685, 36589745, 38261399, 37450688, 38180394, 38510732'},
  { 'min_version': '12.2.9',  'max_version': '12.2.9.999999',  'fix_patches': '38298685, 36589745, 38261405, 37450688, 38180394, 38510732'},
  { 'min_version': '12.2.10', 'max_version': '12.2.10.999999', 'fix_patches': '38298685, 36589745, 38261413, 37450688, 38180394, 38510732'},
  { 'min_version': '12.2.11', 'max_version': '12.2.11.999999', 'fix_patches': '38298685, 36589745, 38261420, 37450688, 38180394, 38510732'},
  { 'min_version': '12.2.12', 'max_version': '12.2.12.999999', 'fix_patches': '38298685, 36589745, 38261427, 37450688, 38180394, 38510732'},
  { 'min_version': '12.2.13', 'max_version': '12.2.13.999999', 'fix_patches': '38298685, 36589745, 38261439, 37450688, 38180394, 38500628'},
  { 'min_version': '12.2.14', 'max_version': '12.2.14.999999', 'fix_patches': '38298685, 36589745, 37450688, 38500628'}
];

vcf::oracle_ebusiness::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE, fix_date:'202510');